Security Policy

Factories trust Intelactory with their orders, production, people and evidence. This page describes how we protect that data and how to reach us about security.

1. Your data stays your organization's

• Isolation in the database. Every organization's records are separated by row-level security enforced inside the database itself, so each request can only reach the data of the organization it belongs to.
• Factory and role scope. Inside a workspace, each user sees and changes only what their role and their factories allow. Administrators assign roles; permissions take effect within minutes.
• Complete history. Every important action is recorded with who did it, when, from where and what changed. These records are append-only: they can be read, not edited or removed.

2. Sign-in and sessions

• Sign-in is handled by one service. Sessions use short-lived signed tokens (15 minutes), renewed automatically while you work.
• Renewal tokens can be used once. If an old one is presented again, the whole session is ended, which protects you if a token is copied.
• Multi-factor authentication is available for every user.
• Repeated failed sign-ins are slowed down to stop password guessing.

3. Infrastructure

• Intelactory runs on servers in Singapore. All traffic arrives through Cloudflare, which filters attacks before they reach us; our servers accept web traffic only from Cloudflare.
• Every connection to Intelactory is encrypted with TLS.
• Applications run as unprivileged system users, each with only the access it needs. Internal services listen only on the server itself.
• Stored integration secrets are encrypted with a key held outside the database.
• The database administrator account used by the platform has only the rights it needs, and cannot change the history records.

4. Monitoring and maintenance

• Services are monitored continuously for health and performance.
• File integrity checks and a daily configuration check detect unexpected changes on the servers.
• We track security advisories for every component we run and apply fixes promptly.
• Our websites send a Content Security Policy and collect reports of anything it would block, so we see problems before they reach users.
• Databases are backed up every night, and each backup is checked against a checksum.

5. People and process

• Changes are reviewed and tested before they reach production, and every production change is recorded.
• Access to production is limited to the few people who operate it, using key-based sign-in.
• Intelactory staff access a customer workspace only to support that customer, and such access is recorded in the workspace's activity history.

6. AI features

AI requests go through our own gateway, which controls which provider is used and what is sent. AI features suggest and explain; people decide. Administrators choose which AI features are switched on.

7. Reporting a security issue

We welcome reports from researchers and customers. Email [email protected] with the subject "Security", and include the steps to reproduce and the impact you see. We will confirm receipt, keep you informed, and credit you if you wish. Please give us reasonable time to fix an issue before sharing it, and do not access other organizations' data or disrupt the service while testing.

8. Questions

For security questionnaires or more detail for your IT team, email [email protected].