Security
Privacy software has to be careful with the data it holds. These are the controls in this build.
Transport encryption
Browser and server API calls use AES-256-GCM. The session key is wrapped with RSA-OAEP.
Storage encryption
Grievance text, request details, incident notes and API key copies in the local demo are encrypted at rest.
Least identity
Consent rows store an opaque user reference from your system.
Access
Passwords use Argon2. Sessions sit in HttpOnly cookies. Company roles are owner, admin and member.
Audit
Consent events and workspace actions are hash-chained.
Abuse controls
Login, registration, claims and scans are rate limited. The scanner refuses private and loopback addresses.