Security

5. Security (Art. 28(3)(c), Art. 32) — Annex II

| Measure | Evidence | |---|---| | TLS for all traffic; HSTS and strict headers on web surfaces |; headers on the marketing site; production proxy config not yet done (LAUNCH_CHECKLIST.md 4.6) | | Passwords PBKDF2-HMAC-SHA256 600k, min 15 chars, throttling, TOTP two-factor mandatory for Owner/Admin, sessions server-side with idle/absolute limits | | | API keys and licence keys stored as HMAC hashes (pepper), shown once; scopes; rotation | | | Secrets (webhook secrets, two-factor secrets, Shopify tokens) encrypted at rest with key ids and re-wrap | | | Tenant isolation fail-closed on every query; isolation tests |; tests/ResilientLang.Security.Tests | | Bundles signed (Ed25519), loader verifies signature and hashes, refuses rollback and forgery |; key custody option A (app-held, encrypted) for first launch, per-site keys (D29) | | SSRF-guarded crawler, hostile-input limits | | | Hash-chained, tamper-evident audit log with anchors; retention 30-730 days | | | Logging with secret/e-mail redaction | | | Erasure: tenant erasure orchestrator with 11 module hooks, idempotent, throws on a partial result; gaps listed in section 9 | | | Data minimisation by design: the loader sets no cookies, sends no identifier and contacts only configured delivery hosts (browser-tested); IPs in audit and session records are truncated; e-mails and IPs in throttle tables are keyed hashes | | | Backups: encrypted, 35-day roll-off proposed; a restore test is a launch gate | [planned], LAUNCH_CHECKLIST.md 5.1 | | Vulnerability and dependency management, licence policy | | | Encryption at rest of the database and storage | depends on the host/provider; OPEN / verify (not controlled by our code) | | Customers' BYO provider keys encrypted at rest | stated in API.md, not modelled in the data layer (G6) | Honest statement: none of this has run in production or against real SQL Server, R2 or providers (G8). Open security findings are tracked in and may be disclosed to customers on request OPEN.