Security engineered in, not bolted on
We train teams to defend against attackers, so we build to the same standard. Here's exactly how Chinron is secured — and how those controls map to the frameworks your team answers to. Forward this page to whoever signs off on new vendors.
What's built into the platform
Encryption & data protection
- AES-256-GCM authenticated encryption for sensitive secrets — MFA seeds and integration credentials
- Passwords hashed with bcrypt — never stored in recoverable form
- Media stored privately in S3 and served via short-lived, signed URLs
- Payments handled by Stripe; card data never touches our servers
- Data provisioned in your region (data residency)
Authentication & access control
- Multi-factor authentication (TOTP), with MFA secrets encrypted at rest
- Granular role-based access control enforced on every endpoint
- Signed JWT sessions, revoked server-side on logout — not just deleted client-side — so a stolen token can’t be replayed after sign-out
- Every request re-validates the account — a disabled user loses access immediately
- Rate-limited login attempts, with a temporary account lockout on top after repeated failures
- Permission denials logged for monitoring
Tenant isolation
- Every record scoped to your organisation — queries never cross tenant boundaries
- Separate super-admin and MSP access boundaries
- Isolation enforced at the application layer on every request
Threat detection & response
- Real-time anomaly detection: login-time, impossible travel, new device, behaviour and velocity
- GeoIP and device fingerprinting on access
- Automated response — step-up verification or temporary restriction on suspicious activity
- Layered rate limiting across login, accounts and API access
Secure development & data access
- Fully parameterised database queries — protection against SQL injection
- Server-side input validation on every request
- Enforced password complexity (length and character mix) and time-limited password-reset links
- Security headers including Content-Security-Policy (Helmet), strict CORS and TLS in transit
- Email authentication (SPF, DKIM and DMARC) on all sending domains
API & integration security
- API keys are one-way hashed at rest — not encrypted, so not even we can recover them — and shown only once on creation
- Keys are scoped to specific permissions and rate-limited
- Inbound webhooks (e.g. Stripe) are cryptographically signature-verified
- Directory sync connects over OAuth — no provider passwords stored
Auditability
- Audit logging across security-relevant actions
- Exportable history for audits and investigations
- Permission denials and authentication events captured for monitoring
Data retention & deletion
- Automated data lifecycle management — deletion doesn’t wait on a manual process
- Accounts are retained through the subscription plus 90 days after cancellation, then erased
- Abandoned trial organisations are deleted in full after 90 days
- On deletion, identifying data is irreversibly destroyed — training records are kept but anonymised, so removing one person never rewrites your organisation’s compliance history
Transport security
- TLS 1.2 and 1.3 only — legacy protocol versions are disabled
- HSTS enforced across the domain and its subdomains, so browsers refuse to fall back to plain HTTP
Internal access controls
- "Login as client" for MSP staff is scoped to their own client organisations only, enforced server-side, not just hidden in the UI
- Impersonation sessions are single-use, short-lived and can’t be refreshed
- Every impersonated action is attributable to the real staff member who started the session, not just the account being viewed
Every release is scanned before it ships
Automated scanning runs in CI on every push to main — a continuous check, not a once-a-year audit.
- Every production container image — frontend, backend and the M365 sidecar — is scanned on every push to
main - The repository itself is scanned for hardcoded secrets and infrastructure misconfiguration on that same push
- Findings are tracked at CRITICAL and HIGH severity where a fix is already available — so the queue reflects real, actionable work rather than noise
- Coverage today is our own application code and images — base OS images (nginx, postgres, redis) aren't yet in scope
Most vendors can point to a report from months ago. Ours runs continuously — on every single release — so what's shown here reflects the platform as it stands today, not a snapshot from last quarter.
Live scan report — locked
Exact packages, versions and current finding counts aren't published on this page — that's a live map of what isn't patched yet, and we'd rather not hand that out to anyone browsing. If you're evaluating us as a vendor, we'll share the current report directly.
Request the current reportMapped to the standards your auditors know
Chinron is engineered to align with the control requirements of the frameworks our customers answer to.
We don't claim a certification we haven't earned. Instead, our controls are built to map to these frameworks, and we're happy to walk your compliance team through exactly how — including our roadmap to formal third-party attestation.
Your data stays in your jurisdiction
Chinron is deployed in-region on regional infrastructure. Australia is live today; a UK, US or EU instance is spun up on request — so your employee records, training data and risk scores remain within the borders your organisation operates in, aligned to your local frameworks.
Who else touches your data
A small number of service providers help us operate the platform — cloud hosting, email delivery, media storage, payment processing, AI content generation, sales-enquiry management, and — where your administrator enables it — staff directory sync.
Full subprocessor list — on request
We don't publish exact vendor names and data locations on a public page — that's more useful as reconnaissance than as reassurance. If you're evaluating us as a vendor, we'll send you the complete, current list directly.
Request the subprocessor listDoing your due diligence?
If you're assessing Chinron as a vendor, we'll provide the detail your process needs — architecture, data handling, sub-processors, and how each control maps to your framework.
Start training your people on their real risk
Spin up a free trial in your region in minutes — or book a walkthrough tailored to your industry.