HTTPS everywhere

All traffic is encrypted with TLS 1.2+. HTTP connections are automatically redirected to HTTPS. HSTS is enforced with a 2-year policy.

Password security

Passwords are hashed using bcrypt with 12 rounds. We never store plaintext passwords or transmit them in logs.

EU-based infrastructure

Data is hosted on servers in the EU. Database and file storage are not publicly accessible — they run on an internal network.

Tenant isolation

All data is scoped by organisation. Users can only access data belonging to their own organisation. No cross-tenant queries are possible by design.

Evidence file protection

Uploaded files are stored outside the public web directory. Downloads require authentication. File paths are randomised UUIDs.

Daily backups

Database and file backups run automatically every day. Backups are retained for 7 days. Restore procedures are documented.

Authentication

Sessions are managed via signed JWT tokens with a secure secret.
All sensitive auth routes (login, register, password reset) have rate limiting.
Password reset tokens are cryptographic random values (256 bits), stored as SHA-256 hashes.
Tokens expire after 60 minutes and are single-use.
Invite tokens expire after 7 days and are invalidated on use or revocation.

Access control

NIS2Pathway uses role-based access control within each organisation:

Owner: Full control, billing access.
Admin: Can manage team and content.
Member: Can create and edit content.
Viewer: Read-only access.
Auditor: Read-only with audit log access.

Audit logging

All significant actions (logins, data changes, evidence uploads, plan changes) are recorded in an audit log. Logs include the user, timestamp and action type. No sensitive values (tokens, passwords) are logged.

Security headers

The following HTTP security headers are set on all responses:

Strict-Transport-Security (HSTS)
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy (camera, microphone, geolocation disabled)

Responsible disclosure

If you discover a security vulnerability in NIS2Pathway, please report it responsibly to security@nis2pathway.com. We will acknowledge your report within 72 hours and aim to resolve confirmed vulnerabilities promptly.

Please do not disclose vulnerabilities publicly until we have had a reasonable opportunity to investigate and fix them.

No certification claims

NIS2Pathway does not currently hold ISO 27001, SOC 2 or any other formal security certification. We follow security best practices consistent with NIS2 requirements, but we do not claim certified status.