Controls that ship today
- Trusted-host tenant resolution (no browser-supplied tenant IDs)
- Dedicated tenant databases
- Session versioning and optional customer TOTP; required platform-admin TOTP
- Private object storage path for evidence
- Application log redaction for sensitive auth URLs
- Fail-closed Laravel mailer with Resend outbox in production
Independent pentest and ASVS Level 2 sign-off remain open gates. Do not present this page as a completed certification.
Related: product overview.
