ARCTIC PARADE / FIELD GUIDE
Security, with clear boundaries.
How workspace access and connector data are handled today.
Workspace separation
Every authenticated workspace request is scoped to its organisation. Resource ownership is checked on reads and writes, with automated tests for cross-workspace access. This is application-level ORM enforcement, not PostgreSQL row-level security or a guarantee that a software defect is impossible.
Team permissions
Administrators manage members, billing, connections, export and deletion. Operators import inventory and edit actions. Viewers read queues and reports. Roles cover every customer in a workspace; there are no customer-specific restrictions. Removing access or changing a role invalidates existing sessions.
Credentials and account protection
Passwords use salted PBKDF2 hashes. Optional authenticator MFA is available on every plan, with encrypted secrets, single-use recovery codes, code replay protection and persisted account lockouts. Password recovery does not remove MFA. Connector secrets are encrypted with a server-held key and are not returned in exports or displayed. Administrators can rotate a stored secret or disconnect and erase it. Revocation of Azure application permissions is a separate action in Azure. Invitations are hashed, single-use and expire after 48 hours; recovery links are single-use and expire after 30 minutes.
Presentation masking
Masking replaces customer, resource and owner labels when sharing the interface. It is a presentation feature; administrators can still deliberately export unmasked workspace records after confirming their password.
Current deployment and assurance
Early access is currently hosted on the founder’s Proxmox infrastructure. Daily local database dumps and encrypted Proxmox-host backups use a 14-day retention period; restoration has been tested. Public HTTPS and secure cookies are deployed. External uptime monitoring is active. Backups on a separate NAS or independent storage remain outstanding. Automated security regression tests and a basic application review have been performed; no independent penetration test or security certification is claimed.
Report a concern
Email arran@arcticparade.com with a description and safe reproduction steps. Do not email customer secrets, passwords or unmasked inventories. There is no published incident-response SLA during early access.