ARCTIC PARADE / PRACTICAL GUIDANCE
Security and access, with clear boundaries.
The controls available today, how evidence is handled, and the assurance still outstanding.
Workspace and role boundaries
Authenticated records are scoped to their subscribing workspace, with resource ownership checks and cross-workspace regression tests. Administrators manage members, billing, connections, export and deletion; operators work with imports/actions and viewers read. Members can see all estates in their workspace. This is application-level enforcement, not PostgreSQL row-level security or customer-specific delegated access.
Account protection
Passwords use salted PBKDF2 hashes. Optional authenticator MFA is available on both plans, with encrypted secrets, single-use recovery codes, replay protection and persisted lockouts. Password recovery does not remove MFA. Removing access or changing a role invalidates sessions. Invitations and recovery links are hashed, single-use and expire.
Read-only cloud access is separate
A workspace account does not authorise access to a cloud account. Connections use separately approved credentials and scope. Azure/AWS configuration collection also needs platform availability, a baseline and connection consent. Scope changes can revoke that consent. The application grants no cloud permissions and does not deploy remediation.
What evidence is retained
Keep only the resource/configuration/version information needed for the selected review. Key Vault checks request object metadata rather than secret values, and ACM checks do not request certificate/private-key exports. Some configuration APIs, including Lambda configuration reads, can return additional sensitive fields; only the selected version/state fields are retained and raw response fields are discarded. Private AWS Health notices retain minimal matched identifiers, status and dates; event descriptions, arbitrary metadata and unrelated resource details are discarded. They do not enter the shared public catalogue.
Credentials, exports and masking
Connector secrets are encrypted with a server-held key and are not displayed or returned in workspace exports. Provider-side credential revocation is a separate offboarding action. Presentation masking hides labels on screen; administrators can deliberately export unmasked records after password confirmation. Do not put secrets in inventory, notes or completion evidence.
Hosting, backups and monitoring
Early access runs on founder-operated Proxmox infrastructure. Daily local dumps and encrypted host backups retain 14 days of copies. Authenticated backup verification and disposable same-host database restores have passed; these do not establish host-loss recovery. Monitoring runs on the Proxmox host. Independent backup storage, separately recoverable keys and off-host monitoring remain outstanding.
Current assurance
Public HTTPS, secure cookies, service restrictions and a container network guard are deployed. Automated regression tests, deployment checks and dependency-advisory reviews have been performed. Router/WAN and shared-network isolation still require verification. No independent penetration test, security certification, complete cloud-security coverage or uptime/recovery SLA is claimed.
Report a concern
Email arran@arcticparade.com with safe reproduction steps and an error reference. Do not send passwords, keys or unmasked customer inventories. Security and availability incidents are prioritised; there is no published incident-response SLA during early access.