Security
Security & trust
DGIConnect was certified at v1.0 with no Critical or High defects. Security and tenant isolation are enforced at the server for every role.
Defence in depth
Enterprise security, enforced server-side
The controls below are part of the platform today — not add-ons.
Role-based access control
Server-enforced RBAC across every role — Platform Admin, Manager, Building Manager, Accountant, Technician, Owner and Resident.
Tenant isolation
Every record is scoped to its organization and company. Cross-tenant access is refused at the server, not just hidden in the UI.
Audit trails
Actions are recorded so you always know who did what and when.
Encrypted, rotated backups
Automated database backups with optional encryption and 30-day rotation, plus a documented restore procedure.
Hardened by design
JWT auth, bcrypt password hashing, strict input validation, rate limiting and parameterised queries — no Critical or High defects at v1.0 certification.
Secure cloud deployment
Containerised on modern infrastructure behind HTTPS/TLS, with health checks and automatic restart.
Under the hood
How we protect your data
Authentication
Token-based authentication with strong password hashing (bcrypt). Secrets are validated at boot and never shipped in code.
Input validation
A strict global validation layer rejects unexpected input and blocks mass-assignment. Database access is parameterised — no SQL injection surface.
Tenant isolation
Every record is scoped to its organization and company. Cross-tenant requests are refused with an authorization error.
Audit & logging
Actions are recorded for accountability, and structured logs redact sensitive fields such as credentials and tokens.
Backups & recovery
Automated database backups with optional encryption and 30-day rotation, plus a documented restore procedure for disaster recovery.
Transport & hardening
Served over HTTPS/TLS with security headers, rate limiting and content-type protections, on containerised infrastructure with health checks.
A note on certifications. DGIConnect follows strong security practices described above. We do not claim formal third-party certifications (such as SOC 2 or ISO 27001) that we do not currently hold — we describe exactly what the platform does. If you have specific compliance requirements, talk to us.
FAQ
Frequently asked questions
Is my data isolated from other customers?
Yes. The platform is multi-tenant with server-enforced isolation: records are scoped per organization and company, and cross-tenant access is refused at the server.
How are passwords stored?
Passwords are hashed using bcrypt. Authentication uses signed tokens, and secret configuration is validated at startup.
Do you take backups?
Yes — automated database backups with optional encryption and 30-day rotation, with a documented restore procedure.
Are you SOC 2 or ISO 27001 certified?
We follow strong security practices but do not claim certifications we do not hold. Contact us to discuss your specific compliance needs.
Security questions? We're happy to go deep.
Book a call and we'll walk your security team through our architecture, access model and data handling.