Listrar registry
Security
This page describes controls that exist in the product today. Where something is a deployment configuration rather than an implemented control, it says so.
Tenant isolation, in two independent layers
Every business query is scoped to the caller's tenant at the data-access layer, so cross-tenant access cannot happen by omission. Underneath that, an independent, database-enforced access-control layer applies the same restriction on every request — a backstop that does not depend on application code being correct. Both layers must fail for data to cross a tenant boundary.
The public rail
Anonymous visitors reach product passports through an access path that carries no tenant context, which narrows every read to published products and their public relations only. The application-level filter for published-only content remains in place — it is no longer the only safeguard between a visitor and another tenant's drafts.
Access control
Permissions follow least-privilege, deny-by-default rules: nothing is permitted unless it has been explicitly granted, and the same rule set governs what a user sees in the product, what a page allows, and what the server ultimately accepts — so those three cannot drift apart. Changing a record's registry status and recording a verification are distinct permissions from editing the catalogue, because they are different acts.
Audit trail
Security-relevant events — sign-in and sign-out, every product create and update, every registry status change, every verification created or revoked — are retained in an integrity-oriented audit trail designed to support traceability and investigation. Entries cannot be edited or removed after the fact.
API security
API access is authenticated and scoped: every key carries explicit permissions, and a request is refused if the key lacks the scope it requires. Usage is metered against a quota, and credentials are handled using practices designed to prevent exposure of a reusable secret. Every input is validated before it reaches storage.
Where data is hosted
The deployment pins an EU region for hosting and the database, and the project's compliance documentation records EU data residency as its design posture. This reflects a deployment configuration, not an independent certification, and this page does not claim otherwise.