Skip to content

Security

Actireq’s security, described as it works.

This page describes the product’s controls as they are today, with no promise or certification we do not hold.

Security and data protection

Access

Who can sign in, and to what.

  • OpenID ConnectSign-in goes through a dedicated identity provider. Passwords of at least 14 characters, lockout after repeated failures.
  • Server-side tokensAccess tokens stay on the server; the browser only receives an HttpOnly, secure session cookie.
  • CSRF protectionEvery request that changes data is checked: a dedicated header, the origin and the request context.
  • Limited sessionsExpiry after inactivity and a maximum lifetime, with regular re-checks against the identity provider.

Authorization

Everyone sees what their role allows.

  • System rolesOwner, administrator, dispatcher, technician, sales, finance and viewer.
  • Detailed permissionsEvery action checks a precise permission on the server, never only in the interface.
  • Custom rolesA custom role can never exceed the rights of the person who creates it.
  • Separate customer accessCustomers have their own identity, limited to their company and, when needed, to selected sites.

Isolation

Your data stays in your organization.

  • Context checked on every requestThe requested organization is verified on every call; an identifier from another organization gives access to nothing.
  • Continuously testedAutomated tests try to reach another organization’s data, route by route.

Data

Transport, files and reports.

  • HTTPS everywhereAll traffic is encrypted, with HSTS; no page is served in clear text.
  • Controlled filesPhotos and documents are checked on upload (size, checksum, type) and downloaded through signed, short-lived links.
  • Report linksA shared report goes through a personal link that is time-limited, revocable, rate-limited and traced.
  • Photos without locationThe field app strips location data from photos before sending them.

Traceability

What was done, by whom, and when.

  • Audit trailEvery command writes its audit record in the same transaction as the change.
  • Idempotent actionsAn action sent twice, for example after a network cut, applies only once.
  • Dependable background workNotifications and background processing are recorded in the same transaction as the action, then run, with retries on failure.

Infrastructure

Built to remain portable.

  • Standard containersThe application, the API and background processing run in standard OCI containers, with no dependency on a proprietary cloud vendor.
  • Open componentsPostgreSQL for data, S3-compatible storage for files, OpenID Connect for identity.
  • BackupsDatabase and files backed up every day, with a documented restore procedure.
  • Security headersA content security policy, protection against embedding in other sites and restricted browser features.

An architecture that is simple to explain

  1. 01Web and field app
  2. 02API
  3. 03Background processing
  4. 04Transactional event queue
  5. 05PostgreSQL
  6. 06File storage
  7. 07Identity provider
Browsers talk to the API; background effects go through a transactional queue; data stays in PostgreSQL and file storage.

Certifications

Actireq does not hold a security certification today. The controls on this page are those of the product as it works. For any security question, write to us.

Ready to turn requests into action?

See how Actireq fits your operations, on your own cases.

Request a demoSign in