Security at BancoOs

Every tenant-scoped table carries a non-nullable organization key, and PostgreSQL Row-Level Security with FORCE ROW LEVEL SECURITY is the primary control: a connection with no tenant context reads zero rows, fail-closed. The application role is a restricted, non-owner role — RLS applies even to us — and production startup verifies this and refuses to boot otherwise. Isolation is regression-tested: for every resource, an Org-A session asserts Org-B rows are invisible.

• Sign-in is exclusively Microsoft Entra ID SSO — no passwords stored, MFA at the IdP, with an optional per-tenant gate that rejects sessions lacking an MFA claim.
• Sessions are 1-hour JWTs delivered as httpOnly cookies, recorded per device, individually revocable (deny-listed server-side), with full login history.
• Role checks (owner/admin/approver/member) are read from the database on every privileged call, so a role change or deactivation applies immediately.
• API keys are hashed (SHA-256) at rest, shown once, expiring and revocable, and act as the issuing user for clean audit attribution.

The audit log is append-only three times over: a database trigger rejects UPDATE and DELETE; each entry is hash-chained to the previous entry for its organization (SHA-256), so any gap or edit breaks verification; and signed chain-tip anchors are shipped on a schedule to a write-once object store, so even a privileged operator rewriting the whole chain would diverge from the immutable anchor history. Retention deletion of ancient audit history is possible only through a database-side function that refuses anything newer than one year or not covered by an anchor — no application configuration can override that floor.

TLS in transit everywhere. Uploaded documents are sealed with AES-256-GCM envelope encryption (per-document data keys wrapped by a master key) on top of provider disk encryption. Session-signing keys rotate without downtime via a documented runbook.

• Idempotency keys on ERP posts and payment execution — a retry can never double-pay.
• Maker-checker on vendor bank-detail changes; configurable multi-level approval thresholds; segregation-of-duties guardrails on membership management.
• Fraud, duplicate, and anomaly engines score every invoice and surface open alerts to admins.

Every external dependency (ERP, bank gateway, tax portal, AI providers, email/chat) sits behind its own circuit breaker with bounded exponential-backoff retries and explicit timeouts. Failures become recorded, recoverable states — never silent drops. Background sweeps self-heal transient failures within bounded retry budgets.

• Uploads are ClamAV-scanned and content-type restricted; production requires scanning or an explicit opt-out acknowledgment.
• Rate limiting per organization/IP; security headers on every response; structured JSON logging with correlation IDs and no secrets or document contents.
• Production preflight rejects insecure configuration (weak secrets, dev login, unencrypted uploads).
• A scheduled verification job probes backups and infrastructure and publishes results to customer dashboards.

No external penetration test has been completed yet (scheduled on the ISO 27001 roadmap), certification audits are ahead of us, and some contact points on these pages are pending our Vietnamese counsel engagement. The Trust Center tracks all of it — we'd rather show you the roadmap than overclaim.