{
  "document": {
    "title": "Acatian Security & Reliability Overview",
    "version": "1.1",
    "reviewed": "26 August 2026",
    "classification": "Public customer information",
    "owner": "Acatian Product Security",
    "contact": "support@acatian.com",
    "canonicalUrl": "https://acatian.com/security"
  },
  "controls": [
    {
      "domain": "Identity, session and access",
      "control": "Time-bounded HMAC-signed sessions with issuer, audience, issued-at, expiry and unique session ID",
      "status": "Implemented",
      "evidence": "server.mjs; automated security tests"
    },
    {
      "domain": "Identity, session and access",
      "control": "HttpOnly, Secure, SameSite=Strict browser session cookie and explicit logout/revocation",
      "status": "Implemented",
      "evidence": "server.mjs; backend tests"
    },
    {
      "domain": "Identity, session and access",
      "control": "Rate limiting, bounded credential input, uniform login errors and temporary lockout",
      "status": "Implemented",
      "evidence": "server.mjs; automated security tests"
    },
    {
      "domain": "Identity, session and access",
      "control": "Role, project ownership and subscription entitlement enforcement",
      "status": "Implemented",
      "evidence": "API authorization tests"
    },
    {
      "domain": "Identity, session and access",
      "control": "Enterprise SSO and MFA",
      "status": "Deployment / external",
      "evidence": "Identity-provider configuration and customer acceptance required"
    },
    {
      "domain": "Identity, session and access",
      "control": "Shared session revocation and account-wide invalidation across application instances",
      "status": "Implemented",
      "evidence": "Persistent session revocation/invalidation state; backend and security tests"
    },
    {
      "domain": "Identity, session and access",
      "control": "Recent-authentication gate for admin, connector-secret and automation actions",
      "status": "Implemented",
      "evidence": "Sensitive route policy and automated security tests"
    },
    {
      "domain": "Application and API security",
      "control": "Origin checks, Fetch Metadata protection, request limits, method allowlist and no-store API responses",
      "status": "Implemented",
      "evidence": "server.mjs; security-hardening tests"
    },
    {
      "domain": "Application and API security",
      "control": "CSP, frame denial, MIME sniff protection, permissions policy and HSTS on HTTPS",
      "status": "Implemented",
      "evidence": "HTTP response headers"
    },
    {
      "domain": "Application and API security",
      "control": "Idempotency keys, serialized mutations and structured error/request identifiers",
      "status": "Implemented",
      "evidence": "server.mjs; backend tests"
    },
    {
      "domain": "Application and API security",
      "control": "Public-cloud connector URLs reject credentials, non-HTTPS targets, localhost and private/link-local addresses",
      "status": "Implemented",
      "evidence": "Connector URL policy and security tests"
    },
    {
      "domain": "Application and API security",
      "control": "HMAC-chained security-event records for sensitive identity, upload and connector actions",
      "status": "Implemented",
      "evidence": "Persistent security event chain and normalized audit index"
    },
    {
      "domain": "Application and API security",
      "control": "Independent penetration test and recurring DAST",
      "status": "External evidence required",
      "evidence": "No completed external report is claimed"
    },
    {
      "domain": "Data protection and model governance",
      "control": "Supabase service credentials remain backend-only; public, anon and authenticated database grants are revoked",
      "status": "Implemented in migration",
      "evidence": "Supabase lockdown migration and tests"
    },
    {
      "domain": "Data protection and model governance",
      "control": "Private object storage, pre-storage type/signature/content inspection, provenance, timestamps, reviewers, branches, versions and audit records",
      "status": "Implemented",
      "evidence": "Application workflows and API tests"
    },
    {
      "domain": "Data protection and model governance",
      "control": "Independent malware scanning and customer-specific DLP",
      "status": "Deployment / external",
      "evidence": "Static application inspection is implemented; independent scanning service and DLP policy remain deployment controls"
    },
    {
      "domain": "Data protection and model governance",
      "control": "Customer-specific retention, deletion, DPA and data residency",
      "status": "Deployment / contract",
      "evidence": "Must be agreed and configured per customer"
    },
    {
      "domain": "Data protection and model governance",
      "control": "GMP electronic records/signatures qualification",
      "status": "External validation required",
      "evidence": "Customer intended-use validation and quality-system approval required"
    },
    {
      "domain": "Reliability and recovery",
      "control": "Liveness, readiness, dependency timeouts, bounded retries, circuit breakers and overload response",
      "status": "Implemented",
      "evidence": "Health API, reliability runbook and scheduled smoke workflow"
    },
    {
      "domain": "Reliability and recovery",
      "control": "Revisioned compare-and-swap writes and duplicate-operation protection",
      "status": "Implemented",
      "evidence": "Supabase persistence implementation and tests"
    },
    {
      "domain": "Reliability and recovery",
      "control": "Database and private-storage backup, checksum verification and restore tooling",
      "status": "Implemented tooling",
      "evidence": "Backup/restore scripts and runbook"
    },
    {
      "domain": "Reliability and recovery",
      "control": "Point-in-time recovery, multi-instance failover and contractual SLA",
      "status": "Deployment / external",
      "evidence": "Managed hosting configuration and signed SLA required"
    },
    {
      "domain": "Secure development and supply chain",
      "control": "Automated syntax, unit, integration, browser, container, performance and security checks",
      "status": "Implemented",
      "evidence": "GitHub Actions CI"
    },
    {
      "domain": "Secure development and supply chain",
      "control": "Tracked-file secret scanning and production dependency audit",
      "status": "Implemented",
      "evidence": "CI security gate"
    },
    {
      "domain": "Secure development and supply chain",
      "control": "CycloneDX software bill of materials",
      "status": "Implemented",
      "evidence": "Downloadable SBOM generated from the lockfile"
    },
    {
      "domain": "Secure development and supply chain",
      "control": "Signed build provenance, vulnerability disclosure SLA and certification audit",
      "status": "Roadmap / external",
      "evidence": "Requires managed signing, triage operations and independent auditor"
    },
    {
      "domain": "Industrial and OT boundary",
      "control": "Public Acatian service does not connect directly to PLCs or safety systems",
      "status": "Architecture rule",
      "evidence": "Threat model and automation gateway design"
    },
    {
      "domain": "Industrial and OT boundary",
      "control": "Customer-site gateway, certificate trust, allowlisted tags, read-only default and commissioning checks",
      "status": "Implemented design",
      "evidence": "Gateway code, site-pack policy and CI container validation"
    },
    {
      "domain": "Industrial and OT boundary",
      "control": "Production OT commissioning, interlock review and IEC 62443 site qualification",
      "status": "Customer / external",
      "evidence": "Site network, certificates, node IDs and approved safety documentation required"
    }
  ]
}