Security
Your firm's data, held like it matters.
GeoFrameworks holds other firms' lab results, employee records, and client billing — data that carries real legal and engineering liability. This page is the honest account of how we protect it: what's in the product today, what turns on when we deploy, and what we haven't done yet.
Every control below is tagged with where it actually stands — no badge we haven't earned.
The highest-stakes control
Tenant isolation
One shared platform holds many firms' data, so row-level scoping is the tenant boundary. Every record belongs to an organization, and one firm can never read another's lab results, invoices, or people.
- Every database row is scoped to an organization — reads and writes carry that filter, or scope through a parent that does.Shipped
- Scope helpers use a strict sentinel so an empty office resolves to no rows, never to every row — a missing filter fails closed.Shipped
- Document and photo downloads verify the requester's org owns the file before streaming; stored names are UUIDs with path-traversal guards.Shipped
- Client-portal links are session-less, dynamically rendered, and scoped to a single token — no path back to another org's data.Shipped
- Any client-supplied id (office, project, role) is re-loaded with the caller's org before use — an id is never trusted to belong to you.Shipped
- Recurring IDOR spot-checks: replay one org's requests under another org's session and assert nothing leaks.Roadmap
Identity & access
Authentication
Sessions are server-side and revocable; passwords are hashed with a modern work factor; and every privileged action authenticates before it touches data.
- Passwords hashed with scrypt — 64-byte derived key, a random per-password salt, and a constant-time compare.Shipped
- Sessions are 256-bit random tokens stored server-side, expiry-checked on every request, with a 30-day TTL.Shipped
- The session cookie is httpOnly and sameSite=lax, and secure in production.Shipped
- Rate limiting on login, invite, and password-reset endpoints.Shipped
- Invite tokens are high-entropy, expire in 14 days, allow one live invite per email, are revocable, and are audit-logged — and can't grant a role above the inviter's.Shipped
- Password-reset tokens follow the same entropy discipline, are single-use, and return the same response whether or not the email exists (no account enumeration).Shipped
- Middleware enforces auth fail-closed, and server components re-check — defense in depth, never middleware alone.Shipped
Injection, output & headers
Application security
The classes of bug that leak or corrupt data are closed at the framework level and re-checked on every release.
- All database access is parameterized through Prisma — no string-built SQL anywhere in the app.Shipped
- React escapes output by default; no user-supplied HTML is rendered raw.Shipped
- Every CSV and spreadsheet export neutralizes formula-injection cells before writing them.Shipped
- Uploads pass an extension and MIME allowlist, a 25 MB cap, an empty-file reject, UUID storage, and a traversal guard.Shipped
- Security response headers ship in the app: X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, a locked-down Permissions-Policy, and a baseline Content-Security-Policy.Shipped
- HSTS is enabled (two-year max-age, includeSubDomains, preload).Shipped
- CSRF: Server Actions verify Origin against Host, and cookies are sameSite=lax.Shipped
- A strict script-src Content-Security-Policy, rolled out report-only first, then enforced.Roadmap
Encryption, backups & monitoring
Data protection
Traffic is encrypted end to end today. Storage encryption, managed backups, and secret vaulting are part of the AWS deployment and go live with the hosted product.
- All traffic is encrypted in transit (TLS 1.2+), with HTTP redirected to HTTPS.At deploy
- Database and file storage encrypted at rest on AWS RDS and S3 with a managed KMS key.At deploy
- Encrypted automated backups with a documented, rehearsed restore drill — an untested backup isn't a backup.At deploy
- Secrets held in AWS Secrets Manager and injected at runtime; third-party keys scoped to the minimum (send-only email, single-bucket storage, messaging-only SMS).At deploy
- An audit log records security-relevant events — invites, role changes, and access — tied to org, actor, and time.Shipped
- In-app error monitoring captures and fingerprints server and client errors for review.Shipped
- Threshold alerting on repeated auth failures, permission-denial spikes, and error rates.Roadmap
Ownership, signatures & subprocessors
Privacy & compliance
The architecture makes the important promise structural: your firm owns its data, and we're a custodian, not the owner. The rest is honest record-keeping.
- Your organization owns its data. GeoFrameworks is a processor and custodian — each firm's data is its own, and never sold or used to train AI models.Shipped
- Typed-name e-signatures are legally valid under ESIGN/UETA — stored with the signer's name and timestamp, tied to the record and reproducible.Shipped
- Test reports, timesheets, and payroll are retained natively to meet the ASTM C1077 (3 yr), FLSA (3 yr), and IRS (4 yr) floors — not hard-deleted inside the window.Shipped
- Subprocessors are limited and published: AWS (hosting, storage, transactional email) and Twilio (SMS).Shipped
- Self-serve data export and org offboarding tooling.Roadmap
What we don't claim
The parts other vendors would hide.
SOC 2: not yet. We're a young company, and we won't paste a badge on the page that we haven't earned. What we can show you is exactly what's in the code today and what turns on at deployment — which is this whole page.
Some controls go live with the hosted product. At-rest encryption, TLS termination, managed backups, secret vaulting, and alerting are part of the AWS deployment — real, but enabled when we launch, not before. We tag those At deployrather than pretend they're already running.
We build to a standard and plan to test it. Our checklist follows the OWASP Top 10:2025 and targets ASVS Level 2, and a professional penetration test is planned before we onboard the first paying multi-tenant clients — with the tenant boundary as the thing to hammer hardest.
The software is a tool, not the engineer. GeoFrameworks provides software only. Test methods, results, and certifications remain the responsibility of the retaining testing agency and its licensed Professional Engineer.
Have a security question we didn't answer?
Ask the person who wrote the code.
Procurement questionnaire, DPA request, or a pointed question about tenant isolation — send it over. You'll get a straight, technical answer, not a sales deflection.