Security

Protections enforced where the data lives.

Organisational knowledge describes how a business really works, which makes it worth protecting carefully. This page describes the protections Origentra has in place today — no more and no less.

Tenant isolation

Each organisation’s knowledge is separated inside the database, so a fault in application code cannot expose it to another organisation.

  • Row Level Security on every table

    PostgreSQL Row Level Security is enabled and forced on every table, so policies apply even to the table owner.

  • References stay inside the organisation

    Every cross-record reference, such as a relationship between two records, is constrained at the database level to records in the same organisation.

  • Dedicated schema and least-privilege role

    Origentra uses its own database schema and a least-privilege database role that cannot read other applications’ data.

Access control

What a person can see and do is decided by their role in the organisation, and checked in two places.

  • Capability-based roles

    Owner, Administrator, Knowledge Steward, Contributor, Reviewer and Viewer each grant specific capabilities. Every action is checked on the server and again in the database.

  • Restricted confidentiality

    Records marked Restricted are visible only to their owner, their steward and roles permitted to view restricted knowledge.

Accounts and sign-in

Origentra manages its own accounts, separately from any other Techvora product.

  • Hashed passwords

    Accounts are local to the application. Passwords are hashed with bcrypt and never stored in readable form.

  • Sessions that are useless if copied from the database

    Only a keyed HMAC of each session cookie is stored, never the cookie value itself.

  • Hardened cookies

    The session cookie (origentra_session) is HttpOnly, Secure and SameSite=Lax, so scripts cannot read it and it is sent only over HTTPS.

  • Rate limiting and lockout

    Repeated failed sign-in attempts are rate limited and lead to a temporary lockout.

  • Private password resets

    Password reset responses are the same whether or not an account exists, so the form cannot be used to discover who has an account.

Integrity and audit

Governance state is changed deliberately and every change leaves a trace.

  • Audited state changes

    Lifecycle, verification and review state can be changed only through audited database functions, not by editing fields directly.

  • Append-only history

    The audit log and each record’s change history are append-only.

  • Archiving, not deletion

    Records are archived rather than silently deleted, so what was once relied on stays traceable.

Evidence files

Files attached as evidence are held to the same access rules as the records they support.

  • Validated uploads

    Evidence files are validated by type and size, up to 5 MB each.

  • No public storage

    Files are stored in the database behind the same access controls as other knowledge. There are no public buckets.

  • Served only to authorised members

    A file is returned only to a signed-in member who is permitted to see the record it belongs to.

Transport and browser protections

Data is encrypted in transit and the browser is told to enforce strict rules.

  • Encrypted connections

    The application is served only over HTTPS, and connections to the database require TLS.

  • Strict security headers

    A Content Security Policy, frame-ancestors 'none' to prevent framing, HTTP Strict Transport Security and X-Content-Type-Options: nosniff.

Hosting and data location

Origentra runs in Ireland on established infrastructure providers. The full list of sub-processors is in the privacy notice.

Application
Vercel, with server functions pinned to Dublin (dub1)
Database
Supabase PostgreSQL in AWS eu-west-1 (Ireland)
AI processing
None. No organisational data is sent to AI providers.
Analytics and tracking
None. No third-party analytics or tracking scripts.
Cookies
Essential only: origentra_session for sign-in and origentra_org to remember the selected organisation.

Reporting an issue

If you believe you have found a security vulnerability in Origentra, please email support@techvora.net with a description of the issue and the steps needed to reproduce it.

Please give us a reasonable opportunity to investigate and fix the issue before sharing it with anyone else, and avoid accessing or changing data that does not belong to you. The same address is the right place for security questions from customers and prospective customers.