Skip to main content
    Back to the overview

    Security & sovereignty

    What we can prove, and what we can't

    Every claim below names the part of the codebase that implements it, and a check on each build fails if that stops existing. The last section is the things we do not have — it is there because you were going to ask, and reading it here is better than finding it in month three.

    Running with no outbound connection

    The reason to deploy this platform on your own hardware is that it keeps working there. These are the pieces that make that true rather than aspirational.

    The model provider is a configuration choice

    Inference routes to hosted providers, or to Ollama and vLLM running on machines you own. On a self-hosted model no prompt, document or requirement leaves your network.

    Implemented in apps/ai/ai_core/api/routers/llm.py

    Every product ships an offline reference bundle

    When the shared reference-data service is unreachable, each product falls back to a generated bundle it carries rather than failing. The same mechanism is what lets a disconnected deployment work at all.

    Implemented in apps/frontend/src/constants/dd-fallback/kpis.generated.json

    The data stores are yours

    Neo4j, Postgres and the object store are ordinary deployments. Nothing is a managed service you cannot run yourself, and the hosted option is a convenience rather than a dependency.

    Implemented in docker-compose.local.yml

    Identity and access

    One sign-in across every product, and a permission model that resolves on two axes rather than one.

    One session, verified by every product

    A central service issues the session; each product verifies it through shared code rather than implementing its own check. There is one place to reason about, and one place to fix.

    Implemented in packages/lasstech-core/src/auth/session.ts

    Multi-factor authentication

    Enrolment, challenge and verification, alongside password sign-in and Google or Microsoft SSO.

    Implemented in apps/auth/src/app/api/mfa/challenge/route.ts

    Revocation is checked when a session is used, not only when it is issued

    Signing someone out has to take effect immediately. Checking only at the mint seam leaves an already-issued token working until it expires, so the check runs at both.

    Implemented in packages/lasstech-core/src/auth/revocation.ts

    Redirects are allowlisted

    Where a user can be sent after sign-in is a fixed list, not a parameter. An open redirect on a login flow is a credential-phishing vector, so it is treated as a security control rather than configuration.

    Implemented in apps/auth/src/app/api/login/route.ts

    Permission resolves on role AND calling application

    An action is allowed when the person is permitted to take it and the application asking is granted that domain. Roles run viewer, analyst, operator, superadmin; the per-application grants are an editable matrix.

    Implemented in packages/lasstech-core/src/auth/policy.ts

    How the software is kept honest

    The controls above are only worth what the engineering process behind them is worth. These run on every change.

    Dependency vulnerabilities fail the build

    New CVEs in dependencies block a merge. This gate was added after twenty-five high-severity advisories were found to be invisible to CI.

    Implemented in scripts/check-dependency-cves.mjs

    A measured quality position, published with its coverage

    Fifty-four criteria across the ISO/IEC 25010 characteristics. Unmeasured criteria are reported as unmeasured rather than scored zero, and the score always travels with the percentage of criteria actually measured.

    Implemented in apps/data-domain/seed-data/quality-criteria.json

    The marketing claims on this site are gated

    The page you are reading is checked against the repository on every build. If a capability named here stops existing, the build fails rather than the page quietly ageing.

    Implemented in scripts/verify-site-claims.mjs

    What we do not have

    Stated plainly. A security page that lists only strengths tells you nothing about the ones it left out.

    • We hold no third-party security certification — not SOC 2, not ISO 27001, not FedRAMP. If you need one, we are not yet the right supplier and we would rather say so here than in month three of a procurement.
    • No independent penetration test has been published. We will tell you the current position on request rather than implying one exists.
    • This marketing site does not set a Content-Security-Policy header. The applications behind sign-in are configured separately; we mention it because a questionnaire will ask, and finding it themselves reads worse than reading it here.
    • The platform supports the workflows that standards such as DO-178C, ISO 14971 and DFARS ask for. It does not make an organisation compliant, and no tool can.

    Questions this page didn't answer

    Send them and we will answer them directly, including the ones with awkward answers.

    Get in touch