Security

• Passwords are hashed with bcrypt at cost factor 12. They are never stored or logged in readable form, and nobody at SafeProG can retrieve one.
• Sessions use signed JSON Web Tokens, held in browser session storage rather than long-lived cookies, and discarded when the tab closes.
• Sessions end automatically after 20 minutes of inactivity.
• Sign-in attempts are rate limited to 20 per 15 minutes per address; general API traffic to 300 per 15 minutes.
• Recipients of proposals and agreements authenticate with a one-time code sent to their email, with a capped number of attempts before the code is void.

Two independent gates decide what a person can reach: their organisation's module catalogue, and their own assignment within it. Both must allow an action for it to be permitted, and both are enforced server-side — the interface hides what you cannot use, but hiding is not the control.

• Role-based access control: Admin, Manager, User, Viewer and Contractor.
• Seat-tier capability gating: View, Field, Lead and Admin carry different permissions independently of role.
• Contractors are confined to a restricted set of modules by design.
• Every organisation's data is isolated. Requests are scoped to the caller's organisation on the server, not filtered in the browser.

• Encrypted in transit with TLS, and at rest by the database platform.
• Customer records are stored in the European Union.
• Strict Transport Security is enforced, so browsers refuse to connect over plain HTTP.
• A Content Security Policy restricts which origins may serve script and receive data, limiting what an injected script could do.
• Clickjacking is blocked: the application refuses to be framed by another site.
• Signed agreements carry a SHA-256 hash of the exact content signed, so a retained copy can be proven unaltered years later.

Records are only useful as evidence if you can show who changed what and when. The audit log captures the actor, the action, the affected record, before-and-after values, the network address in hashed form, and whether the change was made by a person, the system, or suggested by gAnI.

• Only the content you submit to gAnI leaves the platform for processing. It has no standing access to your database.
• Your data is never used to train AI models.
• gAnI produces drafts for review. It does not approve permits, sign off assessments, or make automated decisions about individuals.
• Transfers to our AI sub-processor are covered by Standard Contractual Clauses.

• Changes are reviewed before merge and gated by automated policy checks covering service-worker boundaries, ephemeral storage, kill-switch declarations and health endpoints.
• Secrets are held as environment configuration, never committed to the repository.
• Webhooks from our billing provider are verified by signature against the raw request body before they are trusted.
• Database backups are managed by our database platform with point-in-time recovery.

If you have found a security issue, please tell us before telling anyone else. Write to info@safeproglobal.com with enough detail to reproduce it.

• We acknowledge reports within 2 working days.
• We will keep you informed while we investigate, and tell you when it is fixed.
• We will not pursue legal action against researchers who report in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate before disclosing.
• Please do not test against other customers' data, run automated scans that degrade the service, or access more data than needed to demonstrate the issue.

We do not currently operate a paid bug bounty, and we will not pretend otherwise — but we will credit you if you would like us to.

If you are completing a vendor security assessment and need detail beyond this page, contact info@safeproglobal.com. See also the Privacy Policy for the sub-processor list and data-transfer position.