An honest account of what's built today, and what's still on the roadmap. We'll update this page as our security programme matures — not the other way around.
Passwords are hashed with Werkzeug's PBKDF2-SHA256 (salted, per-user). Plaintext passwords are never stored or logged.
TOTP-based 2FA (compatible with any authenticator app) is available per user, verified server-side with a time-window check.
Five roles — superadmin, admin, editor, auditor, viewer — scope what each user can see and change within their organisation.
Every record is scoped to a company/organisation ID; queries are filtered by tenant so one organisation cannot see another's data.
Session cookies are HttpOnly and SameSite=Lax, marked Secure in production (HTTPS-only), with an 8-hour session lifetime.
Creates, updates and deletes across every module are recorded in an activity log for traceability within your organisation.
INSπRE enforces secure cookies and standard security headers. Whether traffic to your instance is TLS-encrypted depends on your host/reverse proxy (PythonAnywhere, your own nginx, etc.) — we recommend HTTPS-only in production.
Encryption at rest is provided by your database host (e.g. managed PostgreSQL disk encryption). INSπRE does not yet apply application-level field encryption on top of that.
INSπRE is a standard Flask + SQLAlchemy application (Docker & nginx configs included). You can self-host on your own infrastructure if you need full control over data residency.
No SOC 2, ISO 27001, or equivalent audit has been completed for the platform yet. This is on our roadmap as the customer base grows.
We have not yet commissioned a third-party penetration test. Internal review only, to date.
No public uptime/status page exists yet. We'll stand one up as we move customers into production.
If you believe you've found a security issue, please email support@inspre.io with details. We'll acknowledge reports and won't take legal action against good-faith, non-destructive research.