Security at Cyber Horizon

Multi-Tenant Data Isolation

Every customer is an isolated organisation, and every record of tenant data carries that organisation’s ID. What matters is not that the column exists but what forces it to be honoured, so the layers below are described in the order they actually act. (1) Session — the organisation context comes from a cryptographically verified session and is never taken from client input; requests without an active organisation cannot reach tenant data. (2) Application guard, the enforcement layer — every organisation-scoped query is issued through a guard that chains the organisation filter onto reads and stamps it onto writes before the query leaves the application, so a record can never be read from or reassigned to another organisation. It is applied where the database client is created rather than in each route, so a route cannot forget it, and it covers 106 of the 108 organisation-scoped tables automatically; the remaining two hold our built-in library rows alongside each customer’s and are scoped explicitly. (3) Database, the floor — PostgreSQL Row-Level Security is enabled on all 131 tables, and the browser-facing database roles hold zero grants, so a browser cannot read a single row directly even before RLS is consulted. We name the guard as the enforcement layer and RLS as the floor deliberately: the application connects with the service role, which bypasses RLS by design, so during an ordinary request the guard is what separates one customer from another and RLS is the layer that holds if a connection is ever made another way. Automated tests assert both on every deploy, and a drift test fails the build the moment a new organisation-scoped table appears without guard coverage.

Encryption

All traffic is encrypted in transit with TLS (HSTS enforced, 2-year max-age). Data is encrypted at rest with AES-256 at the storage layer. Third-party integration credentials receive an additional application-level layer: AES-256-GCM authenticated encryption with per-record salts, so even direct database access would not expose a customer’s cloud keys or API tokens.

Authentication & Access Control

Authentication is managed by Clerk (SOC 2 Type II certified). We support SSO (SAML 2.0 / OIDC), multi-factor authentication, and configurable sessions. Organisation admins can only manage their own organisation — tenant roles carry no platform privileges. Our platform administration console is a separately gated internal surface, restricted to named staff by an explicit allow-list with two-factor authentication enabled on those accounts. Sensitive platform actions such as tenant provisioning are logged, and emergency break-glass access raises an out-of-band alert.

Infrastructure & Data Residency

Cyber Horizon runs on Vercel edge/serverless with Supabase PostgreSQL. The primary data store for customer data is in the EU (Ireland, eu-west-1), operated by a UK company under UK GDPR. Other sub-processors — authentication, AI processing, email, billing, error monitoring, rate limiting and encrypted off-site backup — process in the regions listed in the DPA, several of them outside the UK/EEA; the transfer safeguards in the DPA apply to those. The platform is multi-tenant with strict database-level isolation: every organisation’s data is separated by PostgreSQL row-level security (RLS), so a tenant can only ever access its own records. For enterprise customers with specific residency or isolation requirements, per-organisation US or UK regional hosting and a dedicated single-tenant database are available on request. Vercel provides DDoS mitigation at the edge.

Application Security

All responses carry strict security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. State-changing API calls are origin-validated (CSRF defence-in-depth), inputs are schema-validated with allow-listed columns (mass-assignment protection), and webhook endpoints verify cryptographic signatures or shared secrets using constant-time comparison. The platform undergoes recurring structured reviews against the OWASP Top 10.

Data Minimisation

We deliberately hold as little of your data as possible. Compliance evidence is stored as links to documents in your own systems (SharePoint, Google Drive, S3, etc.) — the files themselves never leave your infrastructure, so a compromise of our platform cannot expose them. Where a file is uploaded (e.g. a vendor answering a security questionnaire), respondents are nudged toward attestations and links instead, and any uploaded file is automatically deleted within 90 days; only its name, size, SHA-256 hash and timestamp are kept as an integrity record. Integration credentials are encrypted at rest.

Rate Limiting & Abuse Prevention

Requests are rate-limited per API (distributed via Redis where configured, otherwise per-instance). Authentication endpoints carry stricter limits against brute-force and credential-stuffing, and automation endpoints carry per-tenant and global caps.

Audit Logging & Monitoring

Significant actions — logins, role changes, exports, API-key creation — are recorded in a tenant-isolated, append-only audit log with actor attribution. Platform-side administrative actions are separately logged. Errors and anomalies are monitored continuously with alerting (Sentry), with secrets scrubbed from telemetry.

Data Retention & Your Rights

We practise storage limitation under UK GDPR: support data is automatically anonymised 24 months after resolution, and customers can exercise deletion and export rights at any time — organisation data erasure and export are built-in, audited operations. See our Privacy Policy for the full retention schedule.

Engineering Assurance

Every change runs through continuous integration with a suite of 1200+ automated tests — including tests that specifically assert tenant isolation — plus type-checking and dependency scanning (Dependabot, npm audit). We target 30-day remediation for high/critical CVEs and 90 days for medium. We use Cyber Horizon to run our own security and compliance programme — we are our own first customer.

Responsible Disclosure

Email security@cyberhorizon.co with a description and reproduction steps. We acknowledge within 48 hours and provide a resolution timeline within 7 days. We do not pursue legal action against good-faith researchers.

Certifications & Compliance