Security at policyshift

    At policyshift, security is built into how we design access, protect data, and run our platform. We use multiple layers of safeguards so that no single control is relied on by itself.

    1. Secure Account Access

    You can sign in with email/password or trusted OAuth providers (Google and Microsoft 365). For additional protection, two-factor authentication (2FA) is available and supports both email one-time codes and authenticator apps.

    • Password reset links are time-limited
    • Verification codes are short-lived
    • Passwords are never stored in plain text

    2. Strong Access Controls

    policyshift uses role-based access control (for example: Super Admin, Admin, Viewer) to ensure users only see and do what their role allows.

    • Access to sensitive actions is protected by server-side authorisation checks
    • Editing users, managing companies, exporting policy data, and administrative tooling are all role-restricted

    3. Workplace Data Isolation

    Each workplace is logically separated. Access to policies, users, and related records is enforced at the company level so users only access data from their own organisation (unless explicitly authorised for cross-company administration).

    4. Session and Application Security

    We use standard Laravel application protections, including:

    • CSRF protection on state-changing requests
    • Session-based authentication with secure logout handling
    • Session cookie protections such as HttpOnly and SameSite
    • Input validation on forms and uploads to reduce abuse and malformed data

    5. Data Protection

    Sensitive security values are handled securely:

    • Passwords are hashed
    • One-time verification codes are hashed
    • Authenticator secrets are encrypted
    • Application secrets are managed through AWS Secrets Manager rather than hardcoded

    6. Infrastructure Security

    Our production stack is designed with cloud security controls, including:

    • Private application tasks and private database networking
    • Security groups that restrict which services can talk to each other
    • Encrypted RDS database storage
    • Automated backup retention for database recovery
    • Container image scanning in our deployment pipeline

    7. Monitoring and Auditability

    We maintain operational and activity logging to support security monitoring and incident investigation, including important account and policy actions (such as sign-in activity, policy changes, and sharing events).

    8. Billing and Webhook Integrity

    For billing workflows, Stripe webhook events are validated with signing secrets before they are processed, helping protect against forged webhook requests.

    9. Continuous Improvement

    Security is an ongoing process. We continuously review and improve controls, dependencies, and operational safeguards as the platform evolves.