Security

One organisation from another

Every record belongs to one organisation, and every query is held to the organisation it was made in. A person who belongs to two organisations works in one at a time. Automated tests check that every table and every model keeps to this.

Encryption

• Every connection to GovernCore is encrypted, and browsers are told to use only encrypted connections.
• Every file, from board papers to audit evidence, is encrypted at rest with AES-256-GCM under a key that belongs to its organisation alone.
• Secrets for connected services, such as Microsoft 365 and Zoom, are stored encrypted.

Who sees what

A role says what kind of thing a person may do; record rules say which records. Directors see the papers of their own committees, and confidential agenda items only as members. A manager sees the findings addressed to them, not the whole audit file. A privileged legal matter is seen by the company secretary, the compliance officer, the chair and its owner. Speak-up reports are seen by the compliance officer and whoever the case is assigned to.

Signing in

• Passwords are stored as one-way hashes.
• Repeated wrong passwords lock the account for a time, whatever address they come from.
• A sign-in from a browser not seen before is emailed to the account's owner.
• You can see where you are signed in, and sign out everywhere else, from Your account.
• Sessions end after two hours without use.
• Organisations can sign in with Microsoft 365, under their own Microsoft rules, including multi-factor sign-in.

A record that shows change

Every significant action, with who took it and when, is written to the organisation's audit log. Each entry is sealed with a hash of the one before it, so altering or removing any entry breaks the chain from that point; anyone who can open the audit log can check the whole chain in one click.

Packs on devices

A board pack kept for reading offline is encrypted on the device under a key sealed by the reader's PIN. Five wrong PINs erase it. The company secretary can wipe a device from a distance; the wipe happens the next time it connects.

Links and keys

Links that open one thing without a login, such as an auditor's request to someone outside the organisation or a calendar feed, are long, random and stored only as a hash; an answer link closes once used and runs out after three weeks. API keys are shown once and stored as a hash. Pages are sent with headers that stop them being framed by other sites or sniffed as other content.

If something goes wrong

If personal information is lost, disclosed or reached without authority, we tell the organisations affected without undue delay, and within 72 hours of confirming it, and help them tell regulators and the people concerned.

Reporting a weakness

Write to hello@neishot.com with "Security" in the subject: what you found, where, and how to see it. We acknowledge within five working days and keep you told of the fix.

While you look: use only your own account or a test organisation we give you; do not read, change or delete other organisations' records; do not degrade the service or try to trick people; and give us reasonable time to fix a weakness before you tell anyone else. If you keep to this in good faith, we will not take action against you. Machine-readable contact details are at /.well-known/security.txt.