Security & governance

CharterLogic is built for teams that have to defend every number they produce. Security, access control and audit are first-class features of the platform — not optional add-ons.

Authentication

All routes require a verified session. Passwords are hashed with modern key-derivation functions, and privileged roles support TOTP-based multi-factor authentication with recovery codes. Sessions are bound to a token with server-side revocation.

Role-based access control

Every API route and sensitive field is gated by explicit permission codes enforced on the backend. Roles are configurable per tenant and can be mapped to existing organisational structures.

Audit trail

Every create, edit, approval and export is recorded as an immutable audit event including actor, IP address, user-agent, timestamp and a before/after diff. Audit events are visible to authorised admins inside the platform.

Transport & storage

All traffic is served over TLS. Operational data is stored in managed databases with encryption at rest. Deployments can be configured to meet regional data-residency requirements under enterprise terms.

Responsible disclosure

Report vulnerabilities to security@charterlogic.app. We aim to acknowledge reports within one business day.