Security
How we protect your data
Action360 holds operational governance records — actions, risks, changes, readiness and the people accountable for them. This page summarises the controls we operate. It describes our own commitments as the platform owner; it is not an independent assessment.
Encryption
- TLS 1.2 minimum (TLS 1.3 preferred) on every connection, HTTPS enforced with HSTS.
- AES-256 encryption at rest for the database, object storage and all backups.
- Keys held in a provider-managed key management service with automatic rotation.
- Passwords stored as salted one-way hashes; never visible to staff or application code.
Access control
- No public sign-up. Accounts are provisioned by a Super Admin or Admin only.
- Mandatory password change on first login and after any administrator-led reset.
- Six least-privilege roles, with an external Client role limited to dashboard, calendar and reports.
- Authorisation is enforced in the database through row-level security, not in the interface.
Tenant isolation
- Each client is a separate account with its own records, users, groups and settings.
- Every query is scoped to the caller's active account and their group memberships.
- Client-role users are locked to a single account and cannot switch workspaces.
Logging and audit
- User creation, role changes, password resets, approvals and deletions are logged.
- Audit records are append-only — update and delete are denied at database level.
- Every action carries a full activity timeline, exportable to PDF for audit review.
Backup and recovery
- Automated daily backups with continuous write-ahead logging for point-in-time recovery.
- Multi-availability-zone database and object storage inside the agreed hosting region.
- Documented restore runbook with integrity verification and smoke tests, tested periodically.
Retention and deletion
- Client data is retained for 13 months, including activity and audit logs.
- Verified deletion requests are completed within 30 days.
- At contract end, data is exported on request and then deleted; backups age out thereafter.
Data flow and hosting
The browser talks only to the application layer over HTTPS. Server functions verify the caller's token, then read and write the managed PostgreSQL database as that user, so row-level security decides what is visible. Attachments and generated reports live in private object storage reached through short-lived signed URLs. Notification email is queued in the database and dispatched by a background job. Copilot prompts go to the AI gateway for inference only — they are not retained or used for model training.
Full documentation pack
A complete pack is available for procurement and SOW review: a completed security questionnaire, data flow and hosting detail, encryption standards, access control setup, backup and disaster recovery plan, retention and deletion practices, compliance certifications and the subprocessor list. Certification reports are shared under NDA.
Security questions, vulnerability reports or a request for the certification evidence: contact your Action360 administrator, who will route it to the security contact.