Information Security Policy
Security commitments for access control, infrastructure, monitoring and secure development.
Security objectives
STONECODE will protect confidentiality, integrity and availability through least privilege, tenant isolation, secure authentication, protected secrets, encrypted transport, dependency maintenance, backups, monitoring and incident response.
Access control
Access must be granted by role and tenant, reviewed periodically, removed promptly, and logged for sensitive operations. Privileged accounts should use stronger authentication and separate administrative access where practical.
Secure development
Changes should be reviewed, type-checked, tested and scanned for dependency, secret, authentication, authorisation and injection risks. Production data must not be copied into development or test environments without approved protections.
Availability and traffic
Important endpoints use server-side rate limiting backed by PostgreSQL. Capacity, database connections, queueing, timeouts and error rates should be monitored before a production launch and load-tested using synthetic data.