Security

Security posture

What can be said about a product that runs on your hardware: how it is built, what it can reach, what it writes down, and what we do at our end.

Architecture

On-premises install: One application server, one database, both on your network. No cloud component, no intermediary layer, no runtime dependency on an external service.
Air-gapped networks: The product works with no internet access. Version updates arrive as a signed bundle carried inside by your own process, and nothing calls out — including no licence check.
Read-only against your inventory: It reads your server inventory and system-owner records from sources you already run, with read permission. It does not modify them, and it does not apply the patches itself — it coordinates them.
No agent on the managed hosts: Nothing is installed on the servers being patched. Which means: no new attack surface per machine, and no second deployment process to maintain.

Controls in the product

Roles: Two roles, administrator and operator, with an explicit split: an operator can set status and complete a checklist, but cannot create, edit or cancel an event and cannot reach settings.
Audit log: Every state-changing action is recorded with the user, the time and the fields that changed. Deleting an event does not delete its audit record — the record is the evidence that the deletion happened.
Authentication: Against your Active Directory, including group membership checks. We keep no password store of our own.
Logging: Logs are split by function (access, errors, mail, database, directory) and rotate at a fixed size. Passwords and keys are redacted on write.

Secure development

Code review: Every change is reviewed before merge.
Dependency scanning: The dependency tree is scanned automatically and the licence list is rebuilt on every build.
We run it ourselves: Patch coordination for our own infrastructure runs in Regulaxy. That is not a marketing line — it is why most of the bugs that have been found were found by us before a customer met them.

Security incident handling

If we suffer a security incident affecting personal data we control, we notify the people affected and the competent authority within the time the law requires. In the EU that is 72 hours from becoming aware of the breach, under GDPR Art. 33.

counsel: Align this wording with the reporting duties in the Israeli data-security regulations.

An incident on your network, in your installation, is yours — we have no access to it and no way to learn of it. We will assist with an investigation on request.