This page exists so a security questionnaire does not need a meeting. Every control below says how it is enforced, not that it matters. The full write-up, with the file and test names behind each claim, is in the repository as docs/security.md.
Stated here rather than discovered later. We hold no certification of any kind, and nothing in this product or on this site claims otherwise — there is a test that fails the build if it starts to.
Application-level scoping is the kind of control that fails silently the day someone forgets a WHERE clause. So it is backed one layer down.
Every tenant-scoped table has RLS enabled and FORCED, with a policy that reads the scope set on the connection. A query that forgets its predicate returns nothing — not another tenant's rows.
A superuser bypasses RLS unconditionally, so the application must connect as an ordinary role. That is verified at boot, and in production a missing backstop stops the process rather than logging a warning nobody reads.
Isolation is tested adversarially per resource — tenant A attempting to read, mutate and delete tenant B's data — against real PostgreSQL, with the suite connecting as an unprivileged role so it cannot pass by accident.
Redaction that runs after storage protects nothing. This runs twice, and fails closed both times.
The capture agent detects and masks in the page, so the raw value never crosses the network. Detectors cover email, phone, credit card (Luhn-validated), CPF/CNPJ, SSN, IBAN, plus your own patterns.
The agent is code running in your page, so the client pass is defence in depth and the server pass is the enforced one. Every ingest surface goes through the same enforcer.
Both assert against one shared fixture, so a detector changed on one side fails the other's test.
No policy, an unparseable policy, or a missing redaction script all fall back to the strict default. One uncompilable custom pattern is dropped by itself rather than disabling the built-ins.
Which rules were in force on the day of a given capture is answerable, not reconstructed.
A log an administrator can edit is not evidence. This one is append-only and each entry is chained to the one before it.
Each row chains by SHA-256 over the previous hash and the canonical event. There is no update or delete path, and verification recomputes the chain — any altered or removed row fails it, visibly, on the console.
The chain head is emitted to your centralized logs hourly. Because those ship off-database, the anchor detects tampering at the database level — including by a privileged actor.
Access review and chain integrity as a console, a CSV, and a machine-readable endpoint a GRC tool can poll. The export records its own audit event.
Argon2id with a server-side pepper; TOTP second factor, with its secret encrypted at rest. MFA failures count toward the account lockout, because six digits are brute-forceable.
Viewing a recorded session is its own permission, not implied by reading a bug — and a new member does not get it. Each view is audit-logged.
Every token carries an epoch; a password or MFA reset bumps it and every outstanding session stops working immediately.
Per-IP limits and per-account lockout are shared through the database, so a second replica does not silently double the allowance. The lockout stores a hash of the address, never the address.
Self-hosted is a single static binary plus your PostgreSQL: no agent, no sidecar, and no outbound call you did not configure. If your review would fail on "a vendor holds our production logs", that is the mode to evaluate.
Each workspace is pinned to a region and a deployment serves one. A write whose pin does not match is rejected. The settings screen stays reachable, so the pin is always correctable.
The AI provider is per-workspace, including a local model that never leaves your network. Every request carries a no-train opt-out signal.
A capture past the window is hard-deleted and the purge is audited. Deleting a record removes its artifacts, because they are columns rather than references. Dead-lettered payloads are purged with the logs — they hold raw input that never passed through redaction.
Write to security@insightrecorder.com. We will acknowledge the report, tell you whether it reproduces, and tell you when it is fixed. No NDA is required to report, and we will not threaten a researcher acting in good faith.
In September 2026 an internal review produced a list of findings — origin pinning for emailed links, proxy header trust, credential segments redacted from access logs, session revocation, timing-equalized authentication — all fixed, each one now an invariant with a test.
In the same period we found and fixed a cross-tenant notification leak in our own code, before any customer was affected: a detached goroutine dropped the request's tenant, so one workspace's alert could resolve another workspace's credentials. We publish it because how a vendor handles the bug it found itself is the most useful thing a reviewer can know about it.