Cyber Security
Enterprise Security Integrity Charter (MVP)
TaxCoCounsel is built for sensitive cross-border tax matters. This page summarizes our current MVP security controls, deployment requirements, known limitations, and the hardening roadmap for enterprise-grade deployments.
Our security commitments
Defense-in-depth, least privilege, and auditability
We apply layered security controls across identity, access, application safeguards, and evidentiary integrity. Access is designed around least privilege and review discipline, aligned to sensitive tax workflows.
Security at a glance (what we can truthfully claim today)
- Optional SIEM forwarding (best-effort, opt-in)
- Tenant isolation & IDOR mitigations through tenant-scoped authorization and tenant-safe data relations
- Strong session security with production hard-fail if secrets are missing/weak; secure cookie settings
- CSRF protection for unsafe API methods + OWASP baseline security headers
- Rate limiting on high-risk routes (single-instance limitation noted below)
- MFA (TOTP) + backup codes, with step-up authentication for sensitive actions
- Just-in-time admin elevation for high-risk admin operations (time-boxed)
- Tamper-evident audit logging (hash-chained per tenant; not immutable)
- Evidence & export packs encrypted at rest (AES-256-GCM; production hard-fail without key)
- Integrity markers (SHA-256 hashes + manifests) and safe path resolution