Tenant isolation
Every customer's data is scoped to an organization identifier enforced by PostgreSQL row-level security. The application sets the tenant context inside each transaction; a query that forgets the context returns nothing rather than another tenant's rows. Isolation fails closed.
Authentication
- Passwords are hashed with scrypt and a per-user salt. We never store or transmit a readable password.
- Sessions use HMAC-SHA256-signed, httpOnly, SameSite cookies with a seven-day lifetime.
- Time-boxed, single-purpose tokens back email verification and password reset. A reset token cannot be replayed as a verification token.
- TOTP multi-factor authentication is available for every account and enforced on every session of an account that has enrolled; required enrollment for privileged accounts is being completed under our current hardening program.
- Credential endpoints are rate-limited per IP address to blunt brute-force attempts.
Application hardening
- HTTP Strict Transport Security on every application response (max-age two years, includeSubDomains), including the preload directive; browser preload-list inclusion additionally requires submission to hstspreload.org.
- A Content Security Policy restricting script, style, image, and connection sources.
- X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy, cross-origin isolation headers.
- A build-time gate refuses to deploy the application if a required secret is missing or is a known default.
- Privileged actions are written to an append-only audit log with actor, route, and outcome.
Payments
Card data is captured on a Stripe-hosted payment page and never touches our servers or logs. We rely on Stripe as a PCI DSS Level 1 service provider; our own scope is limited to SAQ-A.
Data protection
- TLS 1.2+ in transit for all connections.
- Encryption at rest as provided by our managed database and hosting providers.
- Least-privilege access to production, limited to personnel who require it.
- Errors and reliability signals are monitored; secrets are never logged.
- Submission-time controls block CUI, FCI, classified, source-selection sensitive, procurement-sensitive, and export-controlled technical data from AI/report workflows because the Service does not currently represent a CUI-authorized boundary.
What we have not done
DSS Nexus is built to enterprise security standards - tenant isolation at the database and application layers, MFA enforced on every enrolled account, encryption in transit and at rest, audited access, and a no-training data posture. Formal SOC 2 Type II is part of our planned assurance program; FedRAMP authorization will be pursued in step with federal customer demand. DSS Nexus does not represent either certification as completed.
We hold no third-party security certification today. We have not completed a SOC 2 Type II audit, an ISO 27001 certification, or a FedRAMP authorization, and we have not commissioned an independent penetration test. We publish this because a security page that omits it is not a security page.
Send security questionnaires and vulnerability reports to info@dssadvisorygroup.com. We acknowledge reports within two business days.