Security & Trust

Built for the procurement review, not just the pilot

Most delivery tools are easy to trial and hard to approve. DigitalStack360 holds client work, commercial rates, and engagement history, so the controls that matter to a security team are part of the product rather than a roadmap promise. This page describes what is actually built.

The short version

What a reviewer usually asks about first

Identity and access

Enterprise SSO through SAML with enforcement policies, MFA and passkeys, and controlled break-glass access.

Authorization

Hierarchical permissions evaluated down to module and submodule, with reusable templates and explicit deny.

Financial data controls

Rates and margins are role scoped, so commercial figures stay visible only to the people who should see them.

Audit

A workspace wide audit log spanning every project plus account level events, with export and saved views.

File safety

Every uploaded file is scanned for malware and verified by the server before it is written to storage.

Tenant isolation

Strict per account isolation, with row level security in the database and an authorization layer above it.

Identity and access

Your identity provider stays the front door

Sign in is something your IT organization should control, and revoking someone in one place should be enough.

Enterprise SSO with SAML

Connect your identity provider and let it own who gets in. Provisioning, deprovisioning, and password policy stay where your IT team already manages them.

Enforcement policies

Once SSO is connected, an account can require it. Members sign in through your identity provider rather than through a local credential.

Break-glass access

Enforcement is not a lockout risk. Designated break-glass access lets a named administrator regain entry if the identity provider is unreachable.

MFA, passkeys, and recovery codes

For accounts that authenticate directly, multi factor authentication and passkeys are supported, with recovery codes so a lost device does not become a lost account.

Account switching

People who work across more than one account switch between them explicitly. Each account is a separate authorization context, not a merged view.

Authorization

Access is decided per module, not per login

Getting into the platform and getting into a specific part of it are separate decisions. Permissions are hierarchical and are evaluated down to the module and submodule level, which is what makes it possible to give a client stakeholder a view of delivery without giving them a view of commercials.

Granular hierarchical permissions
Access is evaluated down to the module and submodule level, not just at the product edge. A person can hold access to a workspace without holding access to everything inside it.
Reusable access templates
Common access shapes are defined once as templates and applied to people as they join, so access is consistent instead of hand assembled each time.
Role based grants with explicit deny
Grants come from roles, and an explicit deny can remove a specific capability from someone who would otherwise inherit it.
Permission simulation
Administrators can simulate what a given person or role can actually reach before rolling access out, so the access model is verified rather than assumed.

Commercial figures are role scoped

Rate and margin visibility is treated as its own permission rather than a byproduct of project access. A delivery lead can run the work without seeing what the work bills at, and a contractor or client contact can sit inside a project without ever seeing the economics of it.

  • Rate visibility is granted, not inherited from project membership
  • Margin figures are hidden from roles that are not scoped to see them
  • The same record renders differently depending on who is reading it

One audit log for the whole workspace

Audit is account wide rather than per project. Activity across every project and account level events sit in a single log, so answering who changed what does not require assembling evidence from separate places.

  • Spans every project in the account, plus account level events
  • Saved views for the questions a reviewer asks repeatedly
  • Export for the record, so evidence can leave the platform
File safety

Malicious files never land in storage

Every uploaded file is scanned for malware before it reaches storage. The file is scanned against the scanning service from the client, and the server independently verifies both the scan result and the file checksum before the object is stored. A file that fails either check is rejected rather than quarantined after the fact.

Scanned
Uploads are scanned for malware against the scanning service before storage
Verified
The server checks the scan result rather than trusting the client claim
Checksummed
The checksum is confirmed so the stored object is the file that was scanned
Data handling

Isolation and connected system credentials

Tenant isolation

Data is isolated per account. Row level security policies in the database scope rows to the account that owns them, and an authorization layer above the database applies the permission model on top of that. The two are independent, so a mistake in application code does not by itself expose another account's data.

Account switching is explicit, and each account is evaluated as its own authorization context.

Integration credentials

Connecting a system means handing over a credential, so those credentials are encrypted at rest rather than stored in the clear. Calendar tokens are encrypted as well.

Each account brings its own credentials for the systems it connects. Integrations are authorized per account, not shared across the platform.
API and developer security

Programmatic access is scoped and revocable

Anything that can read the platform over an API is a credential your security team has to reason about, so it is issued narrowly and can be pulled back.

01

Scoped API keys

Keys carry only the scopes they were issued for and are revealed once at creation. After that the value is not retrievable, only rotatable or revocable.

02

OAuth 2.0 with granular scopes

Third party and partner applications authorize through OAuth 2.0. The consent step names the account and the specific scopes being granted.

03

Signed webhooks with rotation

Webhook deliveries are signed so your receiver can verify they came from DigitalStack360, and signing secrets can be rotated without downtime.

04

Per key rate limiting

Limits are applied per key, so one integration cannot exhaust capacity for the rest of the account.

AI data handling

AI is a governed capability, not an open pipe

AI features are subject to the same permission model as the rest of the platform, and usage is metered and rate limited per account. Firms that want AI activity to run through their own provider relationship can bring their own provider key, so the requests are made against their account under their own terms with that provider.

AI usage is governed, so it runs inside the same permission model as the rest of the platform
AI usage is metered per account, so consumption is visible rather than opaque
AI requests are rate limited, so a runaway process cannot spend without bound
Firms can bring their own AI provider key, so AI activity runs through their own provider account
Responsible disclosure

Reporting a vulnerability

If you believe you have found a security vulnerability in a DigitalStack360 product, please report it privately so it can be investigated and fixed before public disclosure. Email [email protected] with the affected URL or component, steps to reproduce, the potential impact, and any supporting evidence.

In scope
  • digitalstack360.com and its subdomains
  • The DigitalStack360 web application
  • The DigitalStack360 desktop application
  • The public API
Out of scope
  • Denial of service testing
  • Social engineering or phishing of staff
  • Issues in third party services, which should go to that vendor
  • Automated scanner output without proof of exploitability

We ask researchers to act in good faith, to avoid accessing or modifying data that is not theirs, and to avoid disrupting service for other users. We will work with you in good faith in return, and we do not pursue legal action against researchers who report in line with these guidelines.

Send us your security questionnaire

DigitalStack360 is built to support enterprise security reviews, and questionnaires are welcome. Send yours and we will work through it directly. If it would help to see the controls in the product, we can walk your team through them live.