Security
Discretion is the product
Practical, verifiable controls — described plainly, without inflated claims.
Data isolation
Every organisation's data is isolated at the query layer. Tenant scoping is applied server-side on every read and write — never left to the interface.
Access control
Six fixed roles with a strict, server-enforced permission matrix. Confidentiality levels — Standard, Restricted, Highly Confidential and Principal Only — further restrict visibility per request.
Encryption
All traffic is encrypted in transit with TLS. Data at rest is encrypted through the hosting and storage providers' infrastructure encryption.
Authentication
Passwords are hashed with scrypt. Sessions are server-side, expiring, and bound to secure, httpOnly cookies. Password resets revoke all existing sessions. Two-factor authentication (TOTP, compatible with standard authenticator apps) is available to every account.
Documents
Files are never publicly addressable. Every download passes through a signed, expiring link that re-checks the caller's organisation and permissions.
Audit logging
Every material action — creation, submission, decision, delegation, comment, document, permission change, export — creates an immutable audit event with actor and timestamp.
Abuse protection
Rate limiting and brute-force protection on authentication and public forms, input validation on every boundary, and security headers including a content-security policy.
Data lifecycle
Organisations can export their data and request deletion. Individual documents can be deleted, with the deletion itself preserved in the audit history.
AI controls
AI assistance is optional and off by default. Nothing is sent to an AI provider without explicit user action; highly confidential content shows a notice first; only processing metadata is retained, never content. Organisations can bring their own API key — encrypted at rest — so AI processing runs under their own account and terms.
Platform operations
Platform administrators see account metadata only. Any privileged support access requires a recorded reason, is time-limited, and is visibly logged.
Responsible disclosure
We welcome good-faith security research. If you believe you have found a vulnerability, email security@principalapprovaldesk.com with enough detail to reproduce the issue. Please do not access other customers’ data, degrade the service, or publicly disclose before we have had a reasonable opportunity to respond. We aim to acknowledge reports within two business days, and we will not pursue action against research conducted in line with this policy.
We describe our controls accurately and do not claim third-party certifications we have not obtained.