How GENV is builtSecurity
How GENV handles credentials, keeps each workspace apart and records who did what.
No compliance certification is claimed: GENV holds no SOC 2, ISO 27001 or equivalent attestation.
Provider credentials
- Held by a secrets store outside the application database. The database records a reference and a version number, never a value.
- Returned by no route to anybody, including an owner. An administrator may replace a credential; nobody may read one.
- Used one call at a time, under the narrowest scope the connector declares — so issue a token with only the privileges it needs.
Workspaces stay apart
A record belonging to another workspace answers exactly as a record that does not exist — the same not-found an unknown identifier gets, so no answer reveals what another business has.
Roles
Five roles, with commercial authority separated from operational authority: the people who take money are not automatically the people who run servers. How that is drawn
Audit
- Every change to what a customer owes or holds leaves a line: who, when and what.
- Refusals are recorded too, so you can answer "who tried" as well as "who did".
- A provider’s own error text is never stored or shown; GENV uses its own words, because provider messages can carry other people’s identifiers.
The application
- Sign-in happens at an identity provider; GENV holds no passwords.
- A strict content security policy, with no inline script and no third-party script on any page, including this one.
- Schema changes that alter shape ship with a tested rollback.
A security address and a disclosure policy are not published yet. See contact and policies.