Security

Built with security from day one.

Everything below is a control that exists in the product today, described plainly. Corven OS does not hold SOC 2, ISO 27001, PCI, or HIPAA certification, and does not claim GDPR certification.

Implemented controls

Tenant isolation

Every record belongs to a workspace, and isolation is enforced by row-level security policies in the database rather than by application code alone. A query from one workspace cannot return another workspace's rows.

Role-based access

Workspace membership carries a role. Read, write, and administrative capabilities are checked against that role on the server for every privileged operation.

Least privilege

Privileged server functions run with pinned search paths and explicitly granted execution rights. Public access is revoked by default, and grants are issued per role rather than broadly.

Secure authentication

Authentication and session management are handled by a managed identity provider. Credentials are never stored by the application, and sessions are validated server-side on protected requests.

Immutable audit logs

Privileged platform actions are written to an append-only audit log that records the actor, the reason, the target, and the result. Entries cannot be edited or deleted after the fact.

Audited support sessions

Internal support access is read-only, time-limited, and requires a written reason before it starts. An active session is visible in the product, and the session is recorded in the audit log.

Credential redaction

Diagnostic views and exports pass through a redaction layer. Tokens, secrets, and raw provider payloads are stripped before anything reaches an operator console.

Owner operations controls

Internal operations tooling lives on separate routes behind a platform-role gate that ordinary workspace roles cannot satisfy, and is excluded from search indexing.

Environment separation

Preview and production run as distinct environments with distinct configuration and secrets. Marketplace integration currently runs against mock providers, so no live seller credentials are in play.

Testing and regression coverage

Automated tests cover role isolation, redaction behavior, permission boundaries, and function privilege expectations, and they run on every change.

Incident management

Operational failures are fingerprinted, aggregated into incidents, and tracked through a lifecycle so recurring problems are visible rather than lost in logs.

What Corven OS never exposes

None of the following are ever returned to a browser, shown in an operator console, or included in a diagnostic export.

Access tokens
Refresh tokens
Client secrets
Raw credentials of any kind
Unrestricted customer payloads

Security contact

Reach the security contact at security@commerce-os.app. Reports are reviewed by the engineering team and acknowledged during the private beta.

Use the contact form

Responsible disclosure

Report suspected vulnerabilities privately before disclosing them publicly.
Include reproduction steps and the impact you observed.
Do not access, modify, or exfiltrate data belonging to another workspace, and do not run denial-of-service or automated scanning against production.
We will acknowledge reports and keep you informed while a fix is developed. There is no paid bug bounty during the beta.