Security and operation #

This page describes the actual controls and operating responsibilities. It constitutes neither a certification nor a guarantee of automatic conformity.

Trust model #

The organization is the multi-tenant border. Repositories filter lists, checkers search for each relationship in the current tenant, and a foreign resource is usually hidden with a 404 response.

The frontend adapts the display to the roles, but the Symfony API makes all the security decisions.

Authentication #

• Argon2id passwords via Sodium;
• Signed JWT lasting 15 minutes;
• refresh rotating token in HttpOnly cookie;
• consultable and revocable server sessions;
• Optional TOTP MFA with one-time backup codes;
• progressive locking after failures;
• account recovery by single-use token valid for 30 minutes.

After a password reset, existing sessions are invalidated.

Permissions #

The general hierarchy is SUPER_ADMIN → ADMIN → RISK_MANAGER → VIEWER. The Auditor and Action Manager roles inherit the reading and add their responsibilities. The documents additionally apply READ, EDIT, and MANAGE.

Secrets #

TOTP, SMTP and OAuth secrets are encrypted with libsodium from APP_SECRET. An API key or webhook secret is only displayed in clear text when it is created. API logs and responses should never contain these values.

In production:

1. generate unique secrets;
2. keep them in a secrets manager;
3. stabilize and save APP_SECRET;
4. protect JWT keys;
5. organize rotation and revocation.

Log and detection #

The technical log is append-only, tenant-aware, and fingerprint-chained. It retains author, resource, date, IP and correlation identifier; sensitive fields are replaced by [REDACTED].

Monitor at least:

• connection failures and lockouts;
• role changes and deactivations;
• creation/revocation of keys and sharing;
• worker and scheduler errors;
• log integrity failures;
• /api/health status and storage saturation.

Documents and shares #

Files remain in a private volume or configured object storage. External links use a random token of which only the fingerprint is stored. Sensitive documents require a password and expiration; any modification revokes the existing links.

Incident response #

First preserve logs, timestamps, and backups. Revoke compromised sessions, keys, or shares, then identify affected organizations and objects. Document timeline, decisions, regulatory notification and feedback in the Resilience module.

Periodic inspection #

These frequencies are recommendations to be adapted to the context, not official requirements of the repository.

Audit-ledger integrity #

The append-only audit chain remains verifiable in production: every event carries integrity material and annual reports identify sealed entries. PDF exports expose neither before/after business values nor client technical data. Monitor chain breaks, keep the HMAC key outside the repository and verify integrity after restoration.