Security

Separation between customers

Each company gets its own tenant. Every database query is scoped by tenant, and cross-tenant isolation is covered by automated tests that run on every change. Nobody signing in from another company's domain can reach your cases, actions or coaching transcripts.

Signing in

Sign-in is by single-use magic link sent to a work email address. Links expire shortly after they are issued and cannot be reused. Sessions are held in a cookie that is HTTP-only, secure and same-site, and they expire after seven days.

Only named addresses can sign in: we set up your first admin, and after that your admins invite each person by email address. An address nobody invited cannot create a session even if someone finds the URL, and an admin can remove someone, which ends their access at once. A blocked address gets exactly the same response as an allowed one, which means the sign-in page cannot be used to discover who has an account.

What we do not have yet

• No per-user roles or permissions. Everyone in your tenant sees everything in your tenant.
• No single sign-on. Magic link only.
• No file or photo upload, so no evidence attachments are stored.
• No security certification. We hold no ISO 27001, no SOC 2, and this page does not imply either.

Where the data sits

Cases, causes, actions and coaching transcripts are stored in Cloudflare D1, a single logical database behind the application. We do not currently guarantee a storage region, and we will not claim one we cannot hold to. If regional storage is a requirement for you, tell us before the pilot rather than after.

Backups and recovery

The database is backed up every night. The backup is encrypted as soon as it is exported and kept for 30 days, and each one is checked by restoring it to a scratch database. There is no guaranteed restore time or uptime commitment during the pilot. The honest summary is that this is a pilot-stage product and you should not put a legal record in it that exists nowhere else. The A3 and fishbone prints are yours to keep, and they are the durable artifact.

Artificial intelligence

Coaching turns are sent to Anthropic's API. Anthropic's commercial terms exclude training on data submitted through the API. The coach proposes causes, asks questions and recommends a method. It never records a verified cause, never changes a method, never records an effectiveness verdict and never closes a case. Those are human actions, by design.

Each tenant has a daily limit on coaching calls, which caps both spend and the effect of any misuse of an account.

Access on our side

Access to production is limited to the founder of Cadence Standard Ltd, who holds the infrastructure and API credentials. There is no support team with a login to your workspace.

Reporting a problem

If you find a security issue, write to us through the contact page at cadencestandard.com/contact with enough detail to reproduce it. We will confirm receipt and tell you what we are doing about it.

See also the privacy notice and the terms.