The practices we've built into CXOkit to keep your organization's data safe
GRC data is sensitive by nature — risks, controls, audit findings, and evidence often touch some of the most confidential parts of a business. Below is a plain description of the security practices actually built into the CXOkit platform today.
Access is governed by granular, per-module permissions (view and manage are controlled separately across every GRC module), so users only see and do what their role allows.
Every customer's data — risks, controls, audits, findings, evidence, and more — is scoped to their own organization at the database query level, so there is no cross-customer data visibility.
Secrets and credentials are configured through the environment rather than hardcoded in source, and debug/error-display modes are disabled in production.
Authentication is session-based, using secure, HTTP-only session cookies to protect against common session-hijacking and script-based attacks.
Every create, update, and delete action across the platform is recorded with who, what, and when, giving your team a complete audit trail.
Database backups run automatically on an hourly schedule, so recent data is consistently protected against loss.
Passwords are never stored in plain text — they're hashed using bcrypt, the industry-standard hashing algorithm built into our application framework.
Talk to our team about how CXOkit fits into your security and compliance requirements