Security

Built to withstand examination.

Compliance software holds some of a practice's most sensitive records. Our standard is that every security claim we make maps to a test, a database invariant or a recorded browser proof in our engineering evidence base — not to marketing copy.

Enforced practice isolation

Every practice's records are separated with database-enforced row-level security — isolation is applied by the database itself, not just application code, and is verified continuously.

Protected sign-in and sessions

Every user signs in with a personal password protected by progressive lockout. Sessions expire on inactivity and are individually revocable, and each practice keeps its own staff and session records.

Tamper-evident audit trail

Every material action is recorded in a hash-chained audit log, so the history of a client file can be verified rather than asserted.

Restricted suspicious-matter workspaces

Suspicious-matter records are isolated from staff without an explicit grant — they do not appear in searches, work queues or audit views for unauthorised users.

Retention aligned to obligations

Evidence records carry seven-year retention aligned to AML/CTF record-keeping obligations, with deletion denied at the database privilege level.

Controlled external-service evidence

External-service results retain their evidence source and verification tier. A controlled test result can never satisfy a real compliance requirement — the database enforces it.

Australian production data plane

Practice compliance records and uploaded evidence files are stored in Neon Postgres in Sydney, with Vercel application functions configured to execute in Sydney.

Infrastructure

The production application database, including uploaded evidence bytes, runs on Neon in Sydney, Australia. Vercel's Next.js and Python application functions are configured for its Sydney region. Connections are encrypted in transit and managed storage is encrypted at rest. All application mutations pass through authenticated, same-origin-checked, schema-validated routes. Internal service endpoints fail closed when credentials are absent.

Data locations and subprocessors

  • Neon: production application records and evidence files are stored in the Sydney region.
  • Vercel: application functions execute in Sydney. Vercel's global network, build and control-plane services may process technical request, deployment and operational metadata outside Australia.
  • Postmark: transactional-email recipient, message and delivery metadata is processed in the United States. Cassandra AML disables tracking pixels and tracked links and does not retain plaintext live email bodies in its database.
  • Optional live services: Didit for identity verification, NameScan for screening and Stripe for billing receive only the data required for a practice-initiated transaction when that service is enabled. Controlled test data does not make a live-provider claim.

Responsible disclosure

If you believe you have found a security vulnerability, email support@cassandraresearch.com. Please include enough detail to reproduce the issue and allow us reasonable time to remediate before public disclosure. We do not take legal action against good-faith research conducted within these guidelines.