Skip to content
    SITEOS

    Trust center

    SiteOS security: what we do, and what we have not done yet

    SiteOS holds no security certification and no audit report, and no penetration test has been run. This page lists the controls that do exist, with the code behind each one, and the programmes we have not started.

    Request a briefingSee how verification works

    Security practicesKnown gapsCertification roadmapReport a vulnerabilityHow to read statuses

    Security practices

    Controls in the code today

    Each control names the file that implements it. Reviewers can ask to see it.

    Security controls and their source
    AreaControlSource reference
    Sign-inPasswords hashed with bcrypt at cost 12. Sign-in throttled per address and per account.backend/database.py · backend/routes/auth.py
    Second factorTime-based one-time passwords with single-use backup codes.backend/routes/auth_2fa.py
    Single sign-onOpenID Connect, authorization code flow with PKCE.backend/routes/sso.py
    SessionsAccess and refresh tokens in httpOnly, Secure cookies. The refresh cookie is SameSite=Strict and scoped to its endpoint.backend/routes/auth.py
    Stored secretsIntegration credentials sealed with AES-256-GCM under a per-secret key.backend/utils/secret_crypto.py
    AuditPrivileged and administrative actions written to a SHA-256 hash chain that can be verified from its first entry.backend/routes/audit_verify.py
    EgressA no-egress mode that refuses connections to public addresses at the socket layer, for air-gapped installations.backend/utils/egress.py
    Controlled dataClassification and export-control caveats (ITAR, EAR, NOFORN, ORCON, REL TO) enforced when data is read.backend/utils/export_control.py
    Abuse limitsPer-address request limits that fail closed, with tighter limits on writes.backend/main.py
    Route reviewA static gate that fails the build when a route is reachable without authentication and is not on a justified list.backend/scripts/security_gate.py
    Personal dataRetention policies, a purge preview and a confirmed erasure endpoint.backend/routes/data_retention.py

    Known gaps

    Published so you do not have to find them.

    • No software bill of materials is generated yet.
    • Dependency vulnerability scanning is not yet wired into our local release gates.
    • No external penetration test has been run. A scope document exists.
    • The content security policy still allows inline styles.
    • Our security.txt is not yet signed: we have no published PGP key.

    Certification and assurance roadmap

    No badges until they are earned

    Each programme with its scope and its real state. Target dates appear here once they are set, not before.

    Certification and assurance programmes and their status
    ProgrammeScopeStatusWhere it stands
    ISO/IEC 27001ELEVEN22SPX LTD, SiteOS development and operationsNot startedNo certification body appointed. Target date not yet set.
    SOC 2 examinationSiteOS hosted serviceNot startedFollows ISO/IEC 27001 work. No auditor engaged and no observation window open.
    CMMC Level 2ELEVEN22SPX USANot startedNo assessment has been booked. Target date not yet set.
    Cyber Essentials PlusFor UK public-sector buyersNot startedNot started. Target date not yet set.
    Penetration testSiteOS web application and APINot startedA scope is drafted. No test has been run, so there is no summary to publish.
    Software bill of materialsEvery SiteOS releasePlannedWill be published with each release once generated.
    Offline-verifiable attestationAir-gapped SiteOS installationsAvailableBuilt and tested. The verifier and a sample file are shared in a briefing.

    Where data goes

    Your installation

    In an installation on your servers, your data stays in your database. With no-egress mode on, the backend refuses connections to public addresses, so there are no sub-processors.

    This website

    No analytics, no advertising trackers, no third-party fonts and no cookies. A briefing request is stored in our own system. Details in the privacy notice.

    Found a vulnerability?

    Tell us first and we will work with you on a fix. Our policy covers scope, how to report and what to expect.

    Read the disclosure policy

    Machine-readable contact: /.well-known/security.txt

    How to read this site

    Statuses and evidence tiers

    Available
    Built in the SiteOS codebase and working in the product today. It describes the software, not a field deployment.
    In progress
    Partly built, or built without full test coverage yet. Ask us for the current state.
    Planned
    On the roadmap. No shipped code yet.
    Not started
    An external programme (audit, certification, test) that has not begun.
    Simulated
    Runs against a software simulator of the device or feed.
    Protocol-tested
    Encoder or decoder covered by automated tests against the published message format. Not yet run against the vendor's hardware.
    Hardware-proven
    Recorded, dated test against real hardware, with the vendor's consent to say so.

    Send us your security questionnaire

    We answer security questionnaires and RFIs with the same honesty as this page: what exists, where it lives in the code, and what does not exist yet.

    Request a briefingReport a vulnerability

    A person reads every request

    Request a briefing