Measures common to the whole TODO.LAW stack →
Data Security
DPO Central is built with defense-in-depth across every layer. As a privacy management platform handling assessment results, incident records, vendor contracts, and data subject requests, security is a foundational requirement, not an afterthought.
Identity & Access
Authentication, authorization, and session management
- Hosted service: sign-in with Google OAuth or a single-use link sent by email. Self-hosted installs default to a local passwordless sign-in, meant for the firm's own network
- Stateless JWT sessions: no server-side session state to compromise
- OAuth tokens are never persisted to the database
- No automatic linking of a new sign-in method to an existing account
- On the hosted service, single sign-on across the TODO.LAW apps through secure, HTTP-only, SameSite=Lax session cookies scoped to the suite's domain
No passwords are used or stored. On the hosted service you sign in with Google or with a single-use link sent to your email address.
- Multi-tenancy: every request for your organization's records checks your membership and filters its queries by your organization
- Five-tier role hierarchy: Owner, Admin, Privacy Officer, Member, Viewer
- Role checks on every change to organization records (personal settings, such as saved views, excepted)
- Deleting records (systems, vendors, contracts, data flows, business units, members, rights requests) is restricted to Admins and Owners
- Application data is read and written through parameterized ORM queries
Application data is accessed through parameterized ORM queries, which keep user input out of the SQL text. The few raw statements (two health checks and one rate-limit counter) are parameterized templates as well.
Application Security
Input handling, API protection, and abuse prevention
- Schema validation on every application (tRPC) endpoint; the other routes check their inputs in code
- HTML tags are stripped from public rights-request submissions
- Parameterized database queries protect against SQL injection
- Detailed validation errors and stack traces are withheld in production
- Timing-safe API key verification on administrative endpoints
- Size and row limits on file imports, and item limits on several bulk operations
- Public DSAR portal validates active configuration before accepting submissions
API key comparisons use constant-time algorithms to prevent timing attacks on administrative endpoints.
- Sign-in and sign-in link requests are rate-limited per client address (counted per server instance)
- Checkout and billing routes are rate-limited
- Public rights-request submissions are throttled to prevent spam
- 429 responses, with Retry-After headers on route-level limits
Data Protection
Transport security, audit logging, minimization, and payment handling
- HSTS with 2-year duration, subdomains, and preload
- Content Security Policy that blocks scripts from other origins (except the payment provider), plugins and framing
- Clickjacking protection via X-Frame-Options: DENY
- MIME sniffing prevention and a strict-origin-when-cross-origin referrer policy
- Camera, microphone, and geolocation disabled by policy
The enforced policy still allows inline scripts, which the framework needs today. A stricter policy with per-request nonces runs in report-only mode, so violations show up before it is enforced.
- Audit log entries for many changes to key records (processing activities, assessments, rights requests, incidents and vendors)
- An organization audit trail for Owners, Admins and Privacy Officers, with CSV export; platform administrators can also see it
- Server errors are logged as a message without stack traces in most code paths
- Many API responses select only the fields the screen uses
- Licence keys are shown masked in the administrative console
- Public email domains blocked from automatic organization membership
- We verify the signature of each payment event Stripe sends us (HMAC-SHA256) and reject any event that fails the check
- Server-side checkout prevents client-side price manipulation
- Paid module entitlements are suspended automatically when a payment fails
Infrastructure
Hosting, encryption, and environment isolation
- Hosted on Vercel with automatic TLS and global edge network
- PostgreSQL database with encrypted connections
- Environment secrets excluded from client bundles
- Development-only endpoints gated by runtime environment checks
Responsible Disclosure
If you discover a security vulnerability, please report it responsibly. Do not open a public issue. Contact us directly at the email address listed in the repository.