Security Compliance
Learn about security compliance and how to implement it effectively.
2 min read
🆕Recently updated
Last updated: 12/9/2025
Security & Compliance Guide
Security, privacy, and organizational compliance are first-class concerns for all production deployments of InnoSynth-Forjinn—whether on-prem, hosted SaaS, or cloud. This guide covers platform security features, best practices, compliance standards, and how to prepare for audits or certifications.
Platform Security Features
- SSO/MFA: Enterprise authentication, two-factor recommended/required (see SSO Configuration)
- Role-Based Access Control: Workspace-level roles, least privilege default, audit log of all changes.
- Secret Management: Credentials manager for API keys/secrets, never exposed to UI/JS, encrypted at rest.
- Data Encryption: All data encrypted at rest (AES256) and in transit (TLS/SSL).
- Logging & Audit: Detailed per-user action logs, login activity, and platform event logs. Exportable for SIEM/SOC2 audits.
Compliance
- GDPR: Full right to access, correct, or delete user data. Data location configurable per org/tenant.
- SOC2: Platform is designed for SOC2 compliance (monitoring, access logs, change management).
- HIPAA: No PHI storage by default; contact support for compliant configurations.
- DPA/Legal: Data Processing Addendum available on request.
best practices
- Enforce strong policies (password, SSO, 2FA) at org/workspace setup.
- Regularly review and rotate API keys/secrets—disable orphaned credentials.
- Assign user roles carefully; periodic access review.
- Monitor logs and set up webhooks/alerts for suspicious actions (see Login Activity).
- Use environment variable or K8s secrets for configuring sensitive values.
Backups & Data Recovery
- Daily automated backups of DB/uploads; retention per admin setting.
- Restore can be performed by platform admin; confirm via restore drills.
- Data deletion is permanent after specified retention window (see Privacy Policy).
Incident Response
- Immediately contact support/security in case of breach or suspected compromise.
- Have a restoration/testing playbook for backup/emergency scenarios.
- Maintain two platform admin accounts with distinct credentials for rapid response.
Compliance Documentation
Security and compliance are a shared responsibility—follow platform best practices and your own legal/DPA guidelines for full coverage. “Security by design” is always the best policy.