Security

Credentials

Your password is never stored in plaintext. Only a salted cryptographic hash is kept, using Django's PBKDF2-SHA256 password hasher. We cannot read the original password and will never ask you for it.

We require at least 12 characters rather than mandatory composition rules, do not force scheduled rotation, do not use security questions, and allow paste so password managers work.

An email address identifies at most one active Workspace, enforced in the database.

Reset and confirmation links are single-use, short-lived and stored only as hashes. A reset token expires after 60 minutes; a confirmation token after 48 hours. Requesting a new link invalidates any earlier one.

A confirmation token is bound to the address it was issued for. Changing the Workspace address prevents an older link from confirming the newer address.

A password change signs out every other session.

Registration, reset, sign-in, invitation-code and confirmation-resend requests deliberately return enumeration-safe responses. Where an address is already in use, the holder is notified without revealing that fact to the requester.

Authentication is rate-limited by address and network origin. Sessions are held in an httpOnly cookie set by the server; browser JavaScript cannot read credentials or session tokens.

Confirmation is not a substitute for authorisation. It proves control of an address; it does not increase what we may disclose.

Two-factor authentication is not currently offered.

Separation of access

The platform maintains three separate access planes — anonymous visitor, authenticated client, and internal team — each with its own authentication, audience and ceiling on what material can be reached. A credential issued for one plane is rejected on another.

What you may see is derived from your plane and your contractual position. It is never taken from something you, or a document you upload, asks for.

Links carry reach, not data

Links we email you carry a signed, scope-limited, time-limited token. A token grants the ability to reach one address; it does not itself carry content, and every request behind it is re-checked against your position at the moment you make it.

Encryption

Production browser traffic is protected in transit using HTTPS/TLS. Stored application data and attachments are kept in access-controlled application and managed storage paths rather than public web paths. We do not publish a specific at-rest cipher, storage-encryption guarantee or customer recovery objective for the free MVP unless it is stated in a separate signed agreement.

Uploads

Every uploaded file is stored as an opaque object outside any publicly reachable path. Before we attempt to read it, it is scanned for malware and checked for archive abuse. Reading happens in an isolated worker with no outbound network access, a memory and CPU ceiling, and a wall-clock timeout.

No uploaded file is ever executed, interpreted, or rendered as active content in a browser. Downloads are served only through a short-lived, authorisation-checked link that forces download rather than display.

A file we cannot read is accepted and represented by its name and type. We tell you that plainly rather than calling it a failure.

Content you upload is not instruction

Text extracted from your files is supplied to our automated components as data to be analysed, never as instructions to be followed.

That is a structural property rather than a matter of wording. The decisions worth attacking — what may be disclosed, who you are, what you are charged, whether a step is approved — are all taken by fixed rules outside the automated component’s reach. An instruction hidden in a document cannot raise what we will tell you, cannot identify you, and cannot approve anything.

Isolation, internal access and governance

Your conversations and attachments are scoped to you. They are not added to the knowledge base the platform answers from, not retrievable by another customer’s session, and not used to train, fine-tune or evaluate any model.

Internal access is role-based and least-privilege. Reading an attachment, releasing a quarantined file, intervening in a live conversation and advancing a commercial step each require an elevated role, and each is logged with the person, the record and the purpose. Releasing a file our scanner flagged additionally requires a recorded reason.

Every outbound message — automated or written by a person — passes an approval check before it reaches you. Material that would require senior approval is not shown to you provisionally at all. Where an automated response begins and then trips a rule, it is stopped and discarded rather than completed, and you are told plainly. We would rather appear slower than tell you something we cannot stand behind.

Logging, deletion and continuity

We log authentication, access to your material, disclosure-level changes, and relevant upload, scan, read, download and approval events. Logs are access-controlled and retained for as long as reasonably necessary for security, incident investigation, accountability and legal obligations.

You can delete a file or a whole conversation at any time; deletion removes the stored object, the extracted text and any derived excerpt. Scheduled deletion runs against the retention periods in the Privacy Policy and writes a verifiable record that it happened.

The platform uses managed infrastructure that may maintain backups or snapshots as part of service operations. The free MVP does not publish or guarantee a backup frequency, backup-retention period, RPO, RTO or uptime SLA. Any customer-specific continuity commitment must be stated in a separate signed agreement.

Incidents, assurance and responsible disclosure

We maintain an incident response process with defined severities and named owners. Where a personal-data breach occurs we notify the supervisory authority and, where required, affected individuals, within the period the applicable law requires. Security contact: itrix@gpslab.org.

We do not claim a security certification or third-party assurance that has not been expressly identified in a current written itriX assurance statement or a signed customer agreement.

If you believe you have found a vulnerability, write to itrix@gpslab.org and give us enough information to reproduce it. Please do not access another person’s data, degrade the service, or disclose publicly until we have had a reasonable opportunity to investigate and fix it. We will not pursue legal action against research conducted in good faith within those limits, and we will acknowledge reports as soon as practicable.