Workspace isolation
Protected Postgres tables use row-level security. The application connects through a role that cannot bypass those policies.
Security
Controls described from the code that enforces them.
A practical security posture for documentation, identities, integrations, and multi-tenant data—without claiming certifications the product does not hold.
Implemented controls
The boundaries in production.
These are software controls present in this repository. A production deployment still needs correct secrets, TLS, database roles, backups, monitoring, and incident response.
Account protection
Passwords use scrypt hashes. Optional TOTP secrets are encrypted, recovery codes are hashed, and authentication routes are rate limited in Postgres.
Session protection
Production sessions use Secure, HttpOnly, SameSite=Lax, __Host-prefixed cookies. Only a SHA-256 hash of each random session token is stored.
Permissions
Owner, admin, editor, and viewer roles are separate from review and publish grants. Business can override roles per project.
Browser boundaries
The writer uses a restrictive Content Security Policy, blocks framing, disallows object content, and sanitizes rendered page HTML.
Audit and integration history
Sensitive workspace actions write attributed audit events. Webhooks and provider callbacks are verified before they can act.
Deployment boundary
Security depends on how the service is operated.
Production must use HTTPS so secure sessions and SAML responses retain their browser protections.
The serving application must use the restricted application connection. Startup refuses a role that bypasses row-level security.
Stored provider credentials require the deployment encryption key. Missing key material disables storage instead of writing plaintext.
Backup policy, recovery objectives, logging access, patching, alerting, and incident response belong to the operator and contract.
Current assurance boundary
What we do not claim.
Staleless does not currently claim SOC 2 or ISO certification, SCIM provisioning, a completed independent penetration test, or universal data residency. Enterprise requirements are agreed before purchase and written into the contract only when they can be met.