Security scope and limitations
These statements describe controls visible in the repository, not an independent security assessment or certification. Deployed infrastructure must be reviewed separately.
Controls implemented in the application
Private trials use salted scrypt password hashes and Auth.js sessions. Company membership, active-account status, role permissions, and trial access are checked before protected logistics reads and writes. Zod validates structured inputs on the server.
Job changes and appended events use database transactions with stale-write guards. Browser security headers restrict framing, content-type sniffing, and camera/microphone/geolocation permissions. The deployment template includes Caddy HTTPS configuration; that template is not proof of the live site's complete TLS or infrastructure posture.
What is not claimed
No certification, NIST 800-53 compliance, SOC 2 report, FedRAMP authorization, AWS GovCloud deployment, sovereign architecture, penetration-test result, encryption-at-rest verification, disaster-recovery guarantee, or uptime commitment is established by this repository.
MFA, enterprise SSO, password recovery, verified email, application-wide rate limiting, malware scanning, and immutable audit storage are not implemented. The contact honeypot is a limited spam deterrent, not comprehensive abuse protection. Hosting, backup, secrets, monitoring, access logging, and incident response need deployment-specific verification.
Demo access and history
The optional role-based demo sign-in is passwordless and restricted to a shared synthetic organization. Enabling it on production is an explicit operator setting; it must never be treated as private customer authentication.
Activity history is append-only through normal application actions. Privileged database access, cascade deletion, and destructive maintenance commands can still alter it. It is not a tamper-proof or independently verified audit log.
Security questions
Contact CivicFlow to request a private security discussion. Do not submit sensitive findings, customer records, or credentials through the public form. Production data scope and security commitments need explicit approval before use.