Security Architecture

Built for firms that
can't afford a breach.

Four technical pillars protect your engineering data: immutable audit trails, zero-trust encryption, database-level tenant isolation, and human-in-the-loop AI governance.

SHA-256 Audit Chain

AES-256 Encryption

PE Digital Seals

HITL AI Governance

Immutable Audit Trail

SHA-256 Hash Chain

Every action is recorded in an append-only PostgreSQL table. Each entry is cryptographically linked to the previous using SHA-256 hash chaining.

Append-only table with database triggers blocking UPDATE/DELETE

SHA-256 hash of previous entry creates mathematical chain

Chain verification detects any tampering instantly

Full actor attribution: firm_id, user_id, timestamp, IP address

One-click chain integrity verification from the Audit Trail page

Zero-Trust Encryption

AES-256-GCM + TLS 1.3

All blueprint and specification data is encrypted at rest using AES-256-GCM and in transit using TLS 1.3. Encryption keys are never stored in source code.

AES-256-GCM encryption at rest for all document storage

TLS 1.3 for all connections in transit

Runtime key retrieval from secure vault (never hardcoded)

Per-file encryption with unique initialization vectors

Automatic key rotation support

Tenant Isolation

PostgreSQL Row-Level Security

Every table has a Row-Level Security policy filtering by authenticated firm ID. Isolation is enforced at the database layer, not the application layer.

PostgreSQL RLS policies on every tenant table

Database-layer enforcement (not application-layer)

firm_id filtering on every query automatically

Cross-tenant data access is mathematically impossible

Supabase-managed infrastructure with SOC 2 compliance

AI Governance (HITL)

Human-in-the-Loop Mandatory

The AI engine is a Drafting Assistant only. No compliance determination is finalized without a human PE Verification Signature.

All AI outputs labeled: "Peer Review Required by PE"

PE digital signature required before any compliance determination

Shadow Judge verification for AI textual grounding

Confidence scoring with automatic escalation below threshold

Full AI decision audit trail with token usage tracking

Technical Specifications

The concrete implementation details for your IT security review.

DatabasePostgreSQL (Supabase) with RLS

Encryption at RestAES-256-GCM

Encryption in TransitTLS 1.3

Audit ChainSHA-256 Hash Linked

AI ModelGemini 2.0 Flash (Google)

AI GovernanceHITL Mandatory

AuthNextAuth.js + bcrypt

HostingVercel (SOC 2)

Verify It Yourself

Don't take our word for it.

Every Flostaq audit entry has a public verification hash. Use our Trust Portal to independently verify any compliance record.

For questions about this security architecture, contact security@flostaq.com