Security claims should be specific and provable.
CEOBAL introduces a secure-platform starter with server-side accounts and private data storage. This page distinguishes controls already built from enterprise controls that still require production deployment and verification.
Controls already present in the application code.
Password hashing
Passwords use PHP password hashing and verification rather than reversible storage.
Session protection
HttpOnly/SameSite cookies, server-side sessions and ID regeneration after authentication.
CSRF protection
State-changing forms require a per-session anti-CSRF token.
Tenant-aware records
Operational records carry a tenant identifier and application queries scope records to the signed-in organisation.
Private storage
The SQLite database sits in a web-denied private data directory rather than a public download path.
Audit evidence
Selected account and operating actions are written to an audit log with hashed IP data.
Enterprise controls that require the next production phase.
CEOBAL should not claim certifications or controls that have not been independently implemented and verified.
MFA / passkeys
Required before broader production rollout, especially for administrators and board environments.
Enterprise SSO
SAML/OIDC integration, domain verification and automated user lifecycle management.
Managed database
Move larger tenants from single-server SQLite to a managed encrypted database with tested backup and restore.
Security testing
Independent penetration testing, dependency scanning, logging review and remediation process.
Compliance evidence
Documented data flows, retention, sub-processors, incident response, DPIAs where required and contractual controls.
Formal certifications
No ISO 27001, SOC 2 or equivalent certification should be stated unless actually obtained and current.
Need a security or procurement conversation?
CEOBAL can provide the current architecture and implementation status without overstating controls.
Responsible security reporting.
Security reports can be sent to [email protected]. A machine-readable security contact file is published at /.well-known/security.txt.
Identity roadmap
Enterprise SSO, MFA/passkeys and lifecycle management remain priority production controls before higher-risk deployments.
Integration governance
The secure Workspace includes an internal integration register so data flows and owners can be reviewed before automation is enabled.
AI governance
The secure Workspace includes an AI system/use-case register for business ownership, data categories, human oversight and internal review.
Automation is separated from authority.
CEOBAL now includes explicit request, approval, workflow, signal, identity and knowledge-control registers. They are control-plane foundations, not a claim that unsupervised autonomous execution is already production-ready.
Approval governance
Material AI, commercial, board and access actions can be routed to a human approval queue.
Workflow registry
Triggers, actions, owners, approval modes and review dates can be documented before activation.
Identity registry
SSO/MFA/provisioning architecture can be documented without storing credentials or claiming unconfigured controls.
What is implemented now — and what still requires a production security programme.
Implemented in the starter
Controlled execution records, contract register, incident register, observability registry, API/webhook governance metadata, tenant-scoped audit CSV exports with SHA-256 digests, session expiry and database-backed login throttling where the Workspace DB is available.
Requires production integration
SSO, MFA/passkeys, secrets management, SIEM, immutable logs, e-signature, hosted payment webhooks, secure file storage, production monitoring and external API execution.
Requires independent assurance
Penetration testing, formal risk assessment, compliance/certification claims and any external audit opinion. CEOBAL does not claim these before they exist.