Security & Compliance Policy

1. OWASP Top 10 Hardened Defenses

Sferafy is engineered to meet or exceed the OWASP Top 10 security standards across all layers of the application stack:

• A01: Broken Access Control: Strict tenant isolation prevents IDOR vulnerabilities. `auth.uid()` derivation ensures clients cannot forge tenant or user identifiers.
• A02: Cryptographic Failures: All data in transit is encrypted using TLS 1.3. Data at rest is encrypted with AES-256 via Postgres storage drivers.
• A03: Injection: Zero raw SQL queries; all database communication relies on parameterized queries through Supabase client drivers.
• A07: Identification and Authentication: Token reuse prevention, 7-day TTL single-use invitation limits, and session token invalidation upon role change.

2. Webhook & Signature Verification

All inbound webhook payloads from external integrations (such as Stripe Checkout and Google Calendar) must present valid HMAC cryptographic signatures. Payloads failing verification or exceeding timestamp skew tolerances (300 seconds) are immediately dropped and audited.

3. Cryptographic Signatures & Verification Digests

Sferafy incorporates cryptographic SHA-256 digital signature chains across critical administrative workflows:

• Policy Wiki Read-and-Acknowledge: Mandatory engineering SOPs record actor session tokens, timestamps, and document version digests, guaranteeing unalterable audit evidence.
• Offboarding Clearance Certificates: Digital employee departure certificates calculate a verifiable SHA-256 fingerprint upon completion of all departmental sign-offs.
• Hardware Custody Ledger: Every physical device handover computes a cryptographic chain-of-custody hash.

4. On-Call Safeguards & EU Working Time Directive

To protect engineering teams from burnout and satisfy statutory labor obligations (including EU Directive 2003/88/EC), Sferafy automatically evaluates late-night incident paging events (22:00–06:00 UTC), verifies a mandatory 11-hour consecutive rest window before daytime shifts, and awards compensatory time off (Comp-Time) balances.

5. Zero-Knowledge Whistleblower Architecture

The Whistleblower Drop Box operates with zero-knowledge anonymity. Submissions do not record client IP addresses or session cookies. System responses and two-way encrypted case updates are accessible exclusively via high-entropy, cryptographically randomized client tokens generated upon case filing.

6. Responsible Disclosure Program

Security researchers who discover potential vulnerabilities are invited to report them directly to security@sferafy.io. We commit to acknowledging reports within 12 hours and resolving critical findings within 48 hours.