Skip to content

Security Hardening

Applies to: All subscriptions

Purpose

Provide a concrete hardening checklist for a Complifly deployment, and state plainly which security questions this portal cannot answer so that they are asked of Complifly rather than assumed.

Audience

Security engineers, system administrators, infrastructure teams, security reviewers.

Prerequisites

Steps

1. Transport

Control Requirement
TLS everywhere externally No plain HTTP except a redirect
Minimum TLS version 1.2, with 1.3 preferred
Modern cipher suites only No legacy ciphers
Complete certificate chain Browsers repair a missing intermediate; ERP integrations do not
Strict transport security header Enabled
Certificate renewal Automated, with a named owner
Database connections encrypted Enabled; certificate trust a recorded decision
Outbound calls validate certificates Where a proxy intercepts, trust it explicitly rather than disabling validation

Verify: The TLS minimum above is a recommendation, not a stated platform requirement. Recorded as assumption E1 in the Assumptions Register.

2. Secrets

Control Requirement
Configuration file permissions Readable only by the service account and administrators
Excluded from source control Verified, not assumed
Distinct per environment Never reuse a production secret in a lower environment
Token signing secret Long, random, unique per environment
Field encryption key backed up separately Losing it makes encrypted values unrecoverable — a database backup contains only the ciphertext
Rotation owned and rehearsed An untested rotation fails when it is needed
Nothing secret in the front-end bundle Anything compiled in is public

The field encryption key is the one item on this list whose loss cannot be recovered by any restore. Back it up somewhere the database backup is not.

Verify: Whether an external secret manager is supported, and how, is not documented here. Recorded as assumption E2.

3. Host

Control Requirement
Patched and supported operating system Baseline
Service account is not administrative Least privilege
Application directory not writable by the web tier The web tier should not modify what it serves
Only required ports listening Verified from outside, not from a configuration file
Time synchronised Token validation and statutory windows both depend on it
Endpoint protection per customer policy Exclude the application's working directories to avoid file-locking faults

4. Network

Control Requirement
Only the reverse proxy is internet-reachable API, worker, database and queue must not be
Database reachable only from application hosts Verified by attempting access from elsewhere
Queue authenticated and internal Unauthenticated queues are a common oversight
Outbound restricted to known destinations See Network and Firewall
Egress address fixed and registered with the provider A changing address breaks all government calls without warning

5. Database

Control Requirement
Least-privilege application login Not an administrative account
Isolation policies present on every tenant-scoped table Including any table added after installation
Policies never disabled to make a tool work Use the supported reporting pattern instead
Backups encrypted and stored off the host A backup on the same host is not a backup
Restore rehearsed Quarterly
Ad-hoc tables treated as unprotected A table created outside the migration path has no policy

6. Application

Control Requirement
Development conveniences absent from production builds Verify by searching the published bundle
Rate limiting active on authentication and ingest Both are present by default; confirm the limits suit the customer
Security headers set at the proxy See Reverse Proxy and TLS
Content-security policy enumerated, not wildcarded Include the download origin deliberately
Cross-origin configuration narrow Exact origins only
Upload limits aligned between proxy and application A mismatch produces confusing rejections
Segregation of duties enforced, or its relaxation recorded An auditor will ask

7. Logging and audit

Control Requirement
Application logs captured and rotated Unrotated logs fill disks
Logs contain no secrets Spot-check after enabling any verbose logging
Audit trail retained Per the customer's retention requirement
Accounts disabled, never deleted Deletion breaks attribution of past actions
Logs shipped to the customer's central platform So that a compromised host cannot erase its own evidence
Alerting on authentication anomalies Repeated failures, unusual sources

8. What this portal cannot tell you

State these openly to a reviewer rather than improvising an answer. Each is an open item for Complifly:

Question Status
Password policy, lockout thresholds, session lifetime Assumption E3 — not stated
Audit log retention and tamper-evidence guarantees Assumption E4 — not stated
Certification posture and penetration-test cadence Assumption E5 — not stated
Supported secret-management integrations Assumption E2 — not stated
Data residency options Confirm with Complifly
Vulnerability disclosure and patch commitments Confirm with Complifly

An unanswered question is a smaller problem than a confidently wrong answer in a signed security questionnaire.

Validation

Check Method Pass condition
External surface minimal Port-scan the environment from outside Only the proxy responds
TLS meets standard External TLS checker Passes, with a complete chain
Security headers present Inspect responses All expected headers
No secrets in the front-end bundle Search the published output None found
Configuration file protected Inspect permissions Restricted
Database not externally reachable Attempt a connection from outside Refused
Isolation enforced Cross-tenant access test with two identities Blocked
Rate limiting active Repeated authentication attempts Throttled
Audit attribution works Perform an action and inspect the trail Correctly attributed
Restore rehearsed Restore into a scratch environment Completes, data correctly scoped
Encryption key backed up separately Confirm its location Recoverable independently of the database backup

Troubleshooting

Symptom Cause Action
Encrypted values unreadable after a restore The field encryption key was not backed up with it Restore the original key. The data cannot be recovered without it
Reporting tool returns nothing Connects without tenant scope Use the supported pattern. Never disable isolation policies
Downloads fail after tightening the content-security policy Download origin omitted Add it explicitly
Provider calls fail after adding a proxy Proxy certificate not trusted Trust it. Do not disable certificate validation
Legitimate traffic throttled Rate limits too tight for the customer's volume Tune deliberately, with evidence
File-locking or antivirus faults Endpoint protection scanning the working directories Add exclusions per the customer's policy
Audit trail cannot attribute an old action An account was deleted rather than disabled Disable, never delete
Logs fill the disk Rotation not configured, or verbose logging left on Configure rotation; return log level to normal
Secrets found in logs Verbose logging enabled during diagnosis Reduce the level, purge the affected logs, and rotate anything exposed