Security Overview
How CVOR protects the documents you put in it.
A reference for security, procurement and compliance reviewers. It describes the controls available in CVOR, in the order a reviewer usually asks about them.
Built with ISO 27001-aligned controls and GDPR design principles.
IDENTITY
Who can sign in, and how they prove it.
| Control | What CVOR provides |
|---|---|
| Enterprise sign-up | Invite only. There is no open registration path into an organisation, so an account cannot exist without someone inside the organisation creating it. |
| Multi-factor | Time-based one-time codes, with recovery codes issued at setup. Enterprise access points require it. |
| Password storage | Argon2id. Passwords are never stored or logged in a readable form. |
| Password policy | Twelve characters minimum, with mixed case, a digit and a symbol. |
| Access tokens | Short-lived, and issued separately for the enterprise and individual surfaces so a token from one cannot be replayed against the other. |
| Refresh tokens | Random and stored only as a SHA-256 hash. A stolen database row cannot be replayed as a session. |
| Document streaming | Authorised by a token measured in seconds, issued per file view. |
| Sessions | Listed and revocable by the account holder, with the address and device recorded against each one. |
ENCRYPTION
Files are encrypted before storage ever sees them.
| Control | What CVOR provides |
|---|---|
| Application-layer encryption | Personal data is encrypted with AES-256-GCM before it reaches the database, using a per-bundle data key rather than one key for the whole system. |
| Bound context | Each encrypted value is cryptographically bound to the organisation and record it belongs to, so a value lifted from one context cannot be decrypted in another. |
| Searchable fields | Fields that must be searched use HMAC-SHA256 blind indexes, so exact-match lookup works without holding the plaintext. |
| Key rotation | Data keys carry a version, so keys can be rotated without re-encrypting everything at once. |
| Key custody | Key handling for deployed environments runs through a managed key service, separate from the application data it protects. |
| Object storage | Server-side encryption protects documents held in object storage. |
ISOLATION
One organisation cannot reach another's records.
| Control | What CVOR provides |
|---|---|
| Tenant scoping | Records carry their organisation. Membership is re-checked on protected requests rather than trusted from the token alone. |
| Roles | Owner, admin and member inside an organisation, with separate compliance and security operator roles held outside it. |
| Rate limiting | Applied per identity and endpoint. Sign-in, multi-factor and recovery fail closed — if the limiter is unavailable, the request is refused rather than allowed through. |
| Upload validation | File type is checked by inspecting the file's own leading bytes, not by trusting the name or the declared type. |
| Browser hardening | Content-Security-Policy, frame denial, MIME-sniffing prevention, referrer and permissions policies, and strict transport security protect browser sessions. |
EVIDENCE
Every action writes a line you can read back.
The audit trail is the product, not a byproduct of it. These are the properties that make it worth relying on in a review.
| Property | What CVOR provides |
|---|---|
| Append-only | Uploads, views, review actions and lifecycle events are written as append-only entries. Entries are not edited in place. |
| Attribution | Each entry carries the actor, the time and the request it belongs to. |
| Delivery guarantee | Audit writes that fail are captured and replayed rather than dropped, so a downstream failure does not silently lose the trail. |
| Evidence export | Audit and evidence records can be exported for a review or an investigation. |
AUTOMATION
Scheduled jobs run whether anyone remembers or not.
Retention, expiry and deadline checks run on a timer. None of them depend on a person noticing that something is due.
| Area | Schedule |
|---|---|
| Retention | Retention scheduling and audit retention sweeps run daily. |
| Legal holds | Hold expiry is checked hourly, so a hold does not outlive its reason by default. |
| Sessions and links | Session expiry runs hourly. Upload sessions and one-time upload links expire on a ten-minute and hourly cycle. |
| Privileged access | Elevated access is expired hourly rather than left standing. |
| Data subject requests | Request deadlines are checked hourly against their service level. |
| Incidents | Incident deadlines are checked hourly. |
| Offboarding | Tenant offboarding processing runs daily. |
| Orphaned records | Records left without a parent are swept every ten minutes. |
DATA SUBJECT RIGHTS
What a person can ask you to do with their data.
Each request type has a workflow and a deadline that is checked hourly rather than tracked in a spreadsheet.
| Right | What it covers |
|---|---|
| Access | Request a copy of the personal data held about you. |
| Rectification | Ask for inaccurate data to be corrected. |
| Erasure | Ask for data to be deleted, subject to retention rules and any legal hold that applies. |
| Restriction | Ask for processing to be limited while a question is resolved. |
| Portability | Ask for data in a portable form. |
| Objection | Object to a particular processing activity. |
CONFIGURATION
Required protections are part of the deployment baseline.
Encryption, storage protection, approved origins and approved hosts are treated as required deployment settings rather than optional recommendations.
These settings are checked as part of deployment readiness, giving security reviewers a defined baseline to verify before sensitive documents are collected.
AT DEPLOYMENT
The surrounding environment matters too.
These infrastructure and operational controls support the platform and should be confirmed for the environment you would use.
| Control | What it covers |
|---|---|
| Transport encryption | TLS termination at the edge with HTTPS enforced and HTTP redirected. |
| Edge protection | Managed WAF with edge rate limiting and bot protection in front of the application. |
| Storage encryption | Managed database encryption at rest, alongside the application-layer encryption described above. |
| Backups | Automated database backups with point-in-time recovery, object storage versioning, and scheduled restore tests. |
| Recovery objectives | Recovery point and recovery time objectives agreed per deployment and recorded contractually. |
| Delivery pipeline | Continuous integration with dependency and static analysis scanning enforced before release. |
| Observability | Centralised log shipping, dashboards, alert routing and synthetic uptime monitoring. |
| Edge delivery | Managed DNS, CDN distribution and certificate lifecycle. |
The exact configuration is deployment-specific. Security and procurement reviewers can request the current position for their proposed environment and record the agreed terms before onboarding.
REVIEW SCOPE
Some answers depend on your deployment.
The platform controls above describe the protections built into CVOR. Infrastructure, service providers and operational commitments can vary by deployment, so their current status should be confirmed for the environment under review.
Reviewers can request the current infrastructure position, subprocessor list, recovery objectives and penetration-test status directly. That gives the review a dated answer tied to the proposed deployment and its requirements.
FAQs
Questions reviewers ask first.
Is CVOR ISO 27001 certified?
No. CVOR is built with ISO 27001-aligned controls across access governance, cryptography, logging, retention, monitoring and incident response, and the control model is organised so that security and procurement teams can review it. Alignment is not certification, and we do not describe it as one.
How is personal data encrypted?
Personal data is encrypted with AES-256-GCM at the application layer, before it reaches the database, using a per-bundle data key that is cryptographically bound to the organisation and record it belongs to. That is a stronger position than relying only on storage-level encryption, because the protection travels with the data rather than with the disk.
Can you show who opened a document?
Yes. Uploads, views, review actions and lifecycle events are written as append-only audit entries carrying the actor, the time and the request they belong to. Audit writes that fail are replayed rather than dropped, so the trail does not develop gaps when something downstream breaks.
What happens to documents that are no longer needed?
Retention scheduling and retention sweeps run daily, legal-hold expiry is checked hourly, and deletion is available on request through the data subject request workflow. Retention runs on a schedule rather than depending on someone remembering.
Send us your security questionnaire.
We answer against your actual requirements, including deployment region, subprocessors, recovery objectives and contractual terms.