Security and controls

All communications take place over TLS. Data at rest are encrypted by the infrastructure providers (Convex, Vercel).

Details on keys and management of encryption at rest: data at rest are encrypted with industry-standard algorithms (AES-256) by the infrastructure providers and the keys are managed by them; OneSpec has no access to the keys and keeps no copy of them.

Role-based access (owner, administrator, member) with server-side checks on every operation. Every sensitive record is linked to the organisation and queries are isolated per organisation.

A single platform super-administrator is defined through a list of email addresses in an environment variable.

Session management with the option to revoke individual devices and sign out of all devices.

Keys and secrets are managed through environment variables of the deployment platform and are not present in the code, logs or error responses.

The application applies HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a Content-Security-Policy that forbids embedding the reserved area. The widget uses a dedicated CSP with the list of domains authorised per organisation.

Limits apply to: sign-in, quotes sent from the widget (per IP and per configurator), data exports. Cloudflare Turnstile anti-bot check on widget submissions.

Administrative actions and sensitive operations (catalogue publishing, status changes, exports, deletion requests) are logged with actor, object and time.

Backups and restore are managed by the database provider. Backup policy, RPO/RTO targets and periodic restore tests: the provider backs up the infrastructure and OneSpec can export the data; contractual RPO/RTO targets are not currently guaranteed; they are checked periodically and communicated on request.

Scanning of dependencies and secrets, updates and security review before releases.

Incident response runbook and notification times: in case of a personal data breach OneSpec starts the internal containment and analysis procedure and notifies the Customer without undue delay and in any case within 72 hours of discovery, so that the Customer can meet the obligations of Art. 33 GDPR.

For security reports: hello@onespec.eu.

For contractual matters, disputes or legal notices concerning this document: office@core829.net.

For sales enquiries: sales@core829.net. For support on the service and requests for custom Enterprise plans: hello@onespec.eu.