1. Security principles
- Tenant isolation: customer records and API operations are scoped to an organization; production PostgreSQL row-level security is an additional required defence.
- Least privilege: organization roles, separate platform roles, and a dedicated support workspace limit access to what a job requires.
- Privileged accountability: platform-owner and support activity is purpose-limited, time-bound where appropriate, and recorded.
- Strong authentication: permanent passwords, one-time activation, authenticator-based 2FA for privileged access, and protected session cookies.
- Private evidence: private object storage, signed delivery, encryption in transit, and encrypted offline evidence queues.
- Safe change management: additive migrations, staging rehearsal, backup and restore drills, rollback planning, compatibility checks, and release verification.
- Secret protection: production credentials belong in a managed secret provider, not source code, browser storage, logs, or downloadable reports.
- Data minimization: platform business intelligence and support operations exclude customer project content unless a separately authorized diagnostic need exists.
2. Security operations
RestoreCheck IQ maintains or plans production-owned controls for monitoring, alerting, vulnerability management, dependency review, backup restoration, retention, incident response, and independent testing. A control is not represented as certified or complete merely because supporting code exists; current production evidence governs.
Customers remain responsible for user lifecycle management, accurate permissions, secure devices, lawful uploads, integration configuration, and promptly removing access that is no longer required.
3. Vulnerability and incident reporting
Report suspected vulnerabilities or security incidents to security@restorecheckiq.ca with the affected feature, time, observed behaviour, and safe reproduction details. Do not include live credentials or unnecessary personal information. We ask reporters to avoid data access, persistence, disruption, extortion, and public disclosure before coordinated review.
No internet service can promise absolute security. This Statement describes control design and commitments; it is not a certification, penetration-test result, or guarantee.