This page summarises security controls implemented in the Log2Map application.
Authentication and access
- Email and password authentication with secure password hashing.
- Optional Google Sign-In (OAuth 2.0 / OpenID Connect) when configured.
- Server-side sessions with httpOnly session cookies (seven-day lifetime).
- Organisation context stored in a separate httpOnly cookie to scope workspace access.
- Inactive or expired sessions are rejected.
Authorisation
- Role-based access control. Active platform roles are System Admin and Member; legacy organisation role values in existing data are treated as Member for access decisions.
- Organisation and project isolation in the data model.
- Administrative areas require platform administrator privileges.
- Upload and export permissions are enforced per resource type.
Data protection in the application
- Private media assets can be served through time-limited signed links.
- File uploads are validated against allowed MIME types and size limits.
- Checksums recorded for uploaded media assets.
- Configurable data masking rules for Task Mining sensitive values.
- Configurable retention settings for certain uploaded and analysis data.
Storage
- Production environments use private object storage for uploaded files and exports.
- Local filesystem storage may be used in development environments.
Network and application security
- Cookie-authenticated API mutations require same-origin requests.
- Rate limiting on authentication, OAuth, and public privacy endpoints.
- Signed OAuth state parameters.
- Security-sensitive routes are protected by authentication middleware.
Logging and monitoring
- Audit logs record actor, entity, action, and change metadata for many administrative and privacy-related events.
- Health check endpoints can require a shared secret header when configured.
Secure development and operations
- Environment-based configuration for secrets.
- Separation of database pooler and direct migration connections in deployment configuration.
Reporting security issues
If you believe you have found a security vulnerability, contact us using the support email published in the site footer.