Product security

The Patchworks platform is designed with robust security controls at every level of our tech stack, ensuring peace of mind for your organisation.

Security by design

Our core product is built using industry-standard frameworks, which are certified as part of our ISO 27001 and SOC compliance. Our Information Security Management System is continuously updated and improved to meet the ever-changing threat landscape. From inception through deployment, security is a fundamental part of our development lifecycle.

Secure coding practices

Our development team adheres to secure coding standards and best practices. Secure coding training is mandatory for all engineers (security awareness training is mandatory for everyone), and regular code reviews are an integral part of our release pipeline.

Security testing

All code repositories are tested with static and dynamic code analysis to ensure clean code, a secure product and the use of appropriate code library licensing.

Separation of customer data

Each customer is provisioned with a dedicated, tenanted database. This ensures strict data segregation.

Strong authentication measures

All passwords are hashed and salted using secure AES cryptographic algorithms. We never store plain-text passwords. Federated SSO FIDO2 Google authentication implementation is in place for all internal and privileged access roles.

Vaulted sensitive data

Sensitive application data (such as API keys and access tokens) is encrypted and securely stored in a protected vault.

Single sign-on (SSO)

Organisations can manage user authentication using their preferred single sign-on (SSO) method, choosing from a range of identity providers. SSO can be assigned at both the company and user levels.

Role-based access control (RBAC)

Role-Based Access Control (RBAC) is strictly enforced throughout the platform - both in the front-end user interface (i.e. the dashboard) and the back-end API layer. Access to features and data is granted according to user roles and permissions, ensuring the principle of least privilege is maintained.