Learn how IT Folder protects sensitive IT data with encryption, access controls, security monitoring, and tested application safeguards.
Multi-layered security architecture designed to protect your most sensitive IT data.
AES-256 encryption protects databases, tenant files, and session storage at rest. Sensitive fields use AES-256-GCM with dedicated data keys protected by tenant AWS KMS keys. KMS key material rotates annually.
Multiple options including authenticator apps, passkeys, email codes, and recovery codes. Passkeys provide phishing-resistant authentication.
Enterprise SAML SSO and Microsoft sign-in are available for the web app. Google sign-in is available in supported native clients. GitHub is an integration, not a web sign-in provider.
Server-side sessions with automatic expiry and 15-minute access tokens. Organizations configure idle timeouts and concurrent-session limits; the default limit is 10 sessions per user.
New passwords use Argon2id hashing with an application pepper. Progressive account lockout begins after 3 failed password attempts, alongside rate limits to reduce automated guessing.
Application-wide request limits and stricter limits on sensitive endpoints, including sign-in and password reset, reduce abuse. Health checks and explicitly exempted routes have separate policies.
Multiple layers of authentication to ensure only authorized users access your data.
Google Authenticator, Authy, and other authenticator apps
Passwordless authentication with biometrics or security keys
One-time codes sent to verified email addresses
Backup codes for account recovery
Single sign-on with your identity provider
Progressive lockout begins at 3 failed password attempts and 5 minutes
Industry-standard HTTP security headers protect against common web vulnerabilities.
Document policies restrict script sources and block inline script handlers; inline styles remain supported
HSTS with includeSubDomains
DENY - prevents clickjacking
nosniff - prevents MIME sniffing
strict-origin-when-cross-origin
CSP frame-ancestors 'none' blocks embedding
These controls are mapped to the OWASP Top 10:2025 risk categories. They describe engineering safeguards and testing, not a certification, a guarantee against every vulnerability, or a third-party audit.
| Category | Risk | Status | Implementation |
|---|---|---|---|
| A01 | Broken Access Control | Controls in place | Role and tenant authorization, BOLA/IDOR regression tests, and validated outbound request destinations |
| A02 | Security Misconfiguration | Controls in place | Restricted CORS, document security headers, and CSP script-source restrictions |
| A03 | Supply Chain Failures | Controls in place | Dependency audits, software inventories, and source/release security checks with documented scope |
| A04 | Cryptographic Failures | Controls in place | Argon2id for new passwords, signed tokens, AWS KMS, TLS 1.2 minimum (TLS 1.3 supported) |
| A05 | Injection | Controls in place | Semgrep + Bandit scans, parameterized queries, SQLAlchemy ORM |
| A06 | Insecure Design | Controls in place | Current-password checks for password changes and session invalidation during administrator resets |
| A07 | Authentication Failures | Controls in place | MFA (TOTP/Passkey/Email), account lockout, rate limiting |
| A08 | Data Integrity Failures | Controls in place | Signed authentication cookies, safe YAML loading, and controlled internal job processing |
| A09 | Security Logging Failures | Controls in place | Structured security events with credential redaction and restricted log access |
| A10 | Improper Error Handling | Controls in place | Centralized error handling and sanitized production error responses |
These are application controls implemented by IT Folder. We have not undergone an independent certification audit and do not claim equivalence or superiority to a bank.
| Security Control | Status |
|---|---|
|
Session Management
Redis-backed, server-side validation |
Implemented |
|
CSRF Protection
Double-submit tokens, per-session Redis binding, and origin checks on protected requests |
Implemented |
|
Token Rotation
Automatic rotation with a 60-second previous-refresh-token retry window |
Implemented |
|
Multi-Factor Auth
TOTP, Passkey, Email OTP, Recovery codes |
Implemented |
| Security Control | Status |
|---|---|
|
Cookie Security
Authentication cookies: HMAC-SHA256 signed, HttpOnly, Secure, SameSite=Lax |
Implemented |
|
Session Fixation
New session ID on MFA promotion |
Implemented |
|
Audit Logging
Structured authentication events with credential redaction |
Implemented |
We document the security information we collect, why we use it, and how it is retained.
We do not generate persistent device fingerprints for tracking. Full IP addresses support session validation, authorized log views, auditing, and investigation. Network/ISP lookups send the queried IP to ipapi.co for enrichment. See our privacy policy for collection and retention details.
Primary application databases, session storage, and tenant file buckets are in AWS US West (Oregon). CDN caches and external service providers have separate processing locations.
Authentication and security events use structured logging with credential redaction. Security and audit logs retain full IP addresses and other identifying information needed for abuse detection and incident investigation, under access and retention controls.
Every tenant gets isolated, encrypted storage with enterprise-grade backup and recovery.
Each tenant has their own encrypted S3 bucket for documents and files.
Continuous replication across multiple Availability Zones.
Automated daily snapshots with point-in-time recovery.
Public HTTPS requires TLS 1.2 or later and supports TLS 1.3. Database and Redis connections, and the load balancer connection to the application, also use TLS.
Our source and dependency checks use the following tools. Findings are reviewed; a successful scan is not a guarantee that software has no vulnerabilities:
Static analysis with 14 custom rules
Python security checks (high-severity, high-confidence CI gate)
Dependency vulnerability scanning
Repository filesystem vulnerability scanning
Start your 14-day free trial and experience enterprise-grade security.