Hand this page to your CISO.
How Farrenio authenticates, authorises, encrypts, audits, and disposes of your data — written for the security review you'll have to do anyway.
MFA-required 69-perm RBAC Encrypted at rest 365-day audit GDPR-aware SOC2-aligned
Authentication & MFA
Strong sign-in by default, recoverable but never bypassable.
- JWT bearer tokens (HS256, 24 h expiry). Tokens are invalidated on logout-all and password change via a per-user `tokens_revoked_at` cut-off.
- TOTP MFA (RFC 6238) supported and enforceable per role. New sign-ins to the code-server gate must complete MFA before reaching a shell.
- Google OAuth as an alternative path — every new Google sign-in is held in a `pending` state until a platform owner approves it.
- Login rate-limiting (5/min) at the auth route, plus a fail2ban filter on /api/auth/*.
- Account-level lockout on the API-token PIN — survives IP changes.
Role-based access control
69 granular permissions across 6 roles; every menu, every action.
- Six built-in roles: platform_owner, admin, customer_admin, customer, technician, service_desk. Plus a marketing-only support_agent role for Aria chat operators.
- 69 individually-toggleable permissions covering navigation, SAP tabs, and actions. Custom overrides editable from the Role Management UI.
- Every privileged route enforces a Depends() RBAC guard server-side. Front-end gating is for UX only — the server is the source of truth.
Encryption at rest & in transit
Sensitive fields are sealed with Fernet; everything travels TLS 1.3.
- SSH credentials, SMTP passwords, OAuth refresh tokens, and API tokens are encrypted at rest using Fernet keys derived from JWT_SECRET.
- Agent-side credentials (HANA / RFC passwords in config.yaml) are wrapped with an `enc:` prefix and a host-local Fernet key.
- Every visitor request hits TLS 1.3 — Caddy at the edge, Let's Encrypt auto-renewal, HSTS preloaded.
- No customer credentials in logs. PIN-revealable plaintext is rendered only client-side after MFA-gated reveal.
Audit trail & retention
Every privileged action recorded for 365 days, queryable from the UI.
- Every login, role change, token reveal, runbook execution, sapcontrol command, and configuration change is appended to db.audit_logs with operator id + IP + outcome.
- Default retention: 180 days. Configurable per customer up to 365 days; SOC2 audits export by date range in CSV / PDF.
- Auth attempts are surfaced live on the Audit Logs page as Security Pulse — failed-login spikes trigger automatic alerts.
Network & transport
No inbound to your SAP hosts, ever.
- The collector agent is outbound-only — it polls Farrenio over HTTPS for its config and pushes metrics the same way. No new firewall rules, no exposed ports on your SAP boxes.
- Per-agent bearer token + customer_id binding; tokens revocable from the Collector Management UI.
- WebSocket fan-out for live dashboards reuses the same JWT — same origin, same TLS, same audit trail.
Data residency & privacy
EU-hosted, GDPR-aware, no third-party trackers.
- MongoDB lives on the same VPS the application runs on, isolated by Docker network with no host port exposed.
- Visitor analytics is opt-in — events only fire when the visitor has accepted the Analytics cookie category. IPs are stored truncated to /24.
- Anonymous pings (consent-free pageview counts) use a daily-rotating sha256 bucket that can't be reversed to a visitor and resets every midnight.
- No third-party tracking on the marketing site. No DoubleClick, no Facebook pixel, no LinkedIn Insight tag.
- Right-to-erasure: chat sessions and demo requests can be deleted by the platform owner; analytics events expire automatically after 180 days.
Vulnerability management
Zero known CVEs in the backend per pip-audit; weekly Dependabot.
- Backend dependency pass keeps pip-audit at zero high-severity findings. Recent waves covered FastAPI, starlette, cryptography, pillow, pymongo, requests, PyJWT, paramiko, ecdsa, aiohttp.
- Frontend transitive vulns are forced via yarn `resolutions` for nth-check, serialize-javascript, underscore.
- Dependabot runs weekly, batched per ecosystem; risk-accepted exceptions (e.g. paramiko #45, ecdsa #4) are documented and dismissed with reasoning.
- Two security-flagged routes are explicitly being tracked: the /discoveries/report agent ingest hardening, and the MongoDB DB-level auth (currently isolated by Docker network only).
Compliance & alignment
SOC2-aligned audit posture, GDPR controller, DPA on request.
- SOC2-aligned audit retention (365 days, immutable append, exportable).
- GDPR data controller is Farrenio SRL, RO44493130. A DPA template is available — reach out for a signed copy.
- The Privacy Policy at /privacy details lawful bases, retention, third-party processors (SMTP, ip-api.com geo, Google OAuth, Anthropic / OpenAI / Gemini for AI features).
Questions a checklist can't cover?
Drop us a line — DPA, sub-processor list, penetration-test summaries, and live security reviews on request.