Security at ItsSuite — One-pager

Last updated: see the version banner at the top of this page.

This document summarises the technical and organisational measures that protect customer data on ItsSuite. It is written to be useful in a procurement / vendor-risk-assessment context — for the formal processing terms see the Data Processing Addendum.

Identity and access

• Mandatory two-factor authentication (TOTP) for every platform administrator. No exceptions.
• Optional two-factor authentication for tenant users. Strongly encouraged for workspace owners and admins.
• Recovery codes issued at 2FA enrolment, single-use; admin and user recovery flows are separate.
• Step-up authentication required for sensitive operations (deleting a workspace, rotating a webhook secret, removing a team member, changing a billing email).
• Role-based access control scoped per workspace: Owner, Admin, Builder, Agent, Viewer. Principle of least privilege.
• No global super-user from the tenant side — platform administrators sign in to a separate /backend console with its own 2FA gate and audit-logged actions.

Encryption

• In transit: TLS 1.2+ on every customer-facing endpoint, every internal service-to-service connection, and every webhook delivery.
• At rest: AES-GCM encryption for all credentials and tokens we store on behalf of customers, including WhatsApp Business tokens, AI provider API keys, webhook signing secrets, and TOTP secrets. Master key sourced from a sealed environment variable; never written to disk.
• Passwords are stored as Argon2id hashes; never in plaintext, never logged, never sent over email.

Audit logging

• Append-only audit log captures every state-changing action on the platform-admin console and every sensitive action on the tenant side (login, password change, 2FA enrolment, workspace destructive ops, billing events).
• Audit log payloads are scrubbed of values that match known credential keys (password, token, secret, key) before persistence.
• Retention is plan-dependent: 30 days (Free) through 5 years (Scale); negotiated on Enterprise.

Multi-tenant isolation

• Database-level scoping on every query path via a account_id WHERE clause; SQL helpers and ORM scopes refuse to issue queries that lack the scope.
• Cross-tenant access is impossible for end-users; platform administrators use a deliberate "support session" flow that is audit-logged on both the minting and the consuming side.

Outbound webhooks

• Signed with HMAC-SHA256 using a per-tenant secret.
• Signing secret rotatable from the tenant settings page.
• We refuse to POST without a signature.

Knowledge base / file uploads

• Uploaded documents stored outside the web root with token-gated URLs.
• Tokens are 192-bit cryptographically random; can be rotated by the owner if a URL leaks.
• File size and MIME-type validated at upload.
• PDF / DOCX text extracted server-side; rendering is sandboxed.

Rate limits and abuse controls

• Per-tenant rate limits on inbox replies, webhook delivery, and outbound messaging — one noisy customer cannot starve another.
• Sliding-window per-IP login rate limits on the auth surface.
• Automated webhook subscription pause after 10 consecutive failures.

Backups and disaster recovery

• Daily encrypted database backups stored off-site for 30 days.
• Weekly automated restore-verification drills.
• Target recovery time objective: 4 hours. Target recovery point objective: 24 hours.

Vulnerability management

• Dependencies scanned daily for CVEs via composer audit (PHP) and npm audit (JS).
• Critical CVEs (CVSS 9.0+) patched within 48 hours of disclosure.
• Annual independent penetration test scheduled before each major feature release.

Incident response

• 24/7 monitoring of error rates, queue depth, and external dependency health.
• Documented incident-response plan defines roles (incident commander, scribe, communications lead), severity levels, and notification SLAs.
• Customers notified of a confirmed security incident within 72 hours of becoming aware of it.

Compliance

• POPIA — Information Officer registered with the Information Regulator of South Africa. See the POPIA Notice.
• DPA — available for signature with any customer on the Growth tier or above. See the DPA.
• Meta WhatsApp Business Platform terms — passed through to the tenant; we do not relabel or rebrand Meta's terms.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email security@itssuite.com with details and reproduction steps. We acknowledge within 1 business day and do not pursue legal action against researchers who follow this responsible-disclosure process.

Initial template — please review with your security lead before publishing externally.