Security
Security built into the architecture
Click IT is designed so that one organisation can never access another's data — enforced in the database, the API and every background process, not just in the UI.
Tenant isolation in depth
Every record carries a tenant identifier; every API, background job, cache key, file, report and export is scoped server-side. Cross-tenant access is covered by automated security tests, and frontend filtering is never trusted for security.
Encryption
Passwords are hashed with Argon2id, secrets are encrypted at rest, and traffic is TLS-protected in production. Integration credentials are never returned by APIs or written to logs.
Identity & access
Email/password with lockout and rate limiting, TOTP multi-factor authentication, session rotation, granular role-based permissions and full audit logging of every action.
Append-only audit
The audit trail is immutable at the database level — UPDATE and DELETE are rejected by trigger. Platform staff access to tenants is itself audited and aggregate-only by design.
How we protect your workspace
Defence in depth
Session security
Short-lived access tokens, rotating refresh tokens, httpOnly cookies and SameSite protection. Unusual or failed logins are audited.
Brute-force protection
Per-account lockout after repeated failures, Redis-backed rate limiting on login, signup and public endpoints.
CSRF & injection defence
Origin checks on state-changing requests, sanitised rich-text input, parameterised queries throughout.
Platform staff controls
Support access to a tenant requires a permission boundary and is aggregate-only, time-limited, visible and fully audited.
Resilience
Health checks, structured logs, correlation IDs, retries and dead-letter queues — one tenant's heavy job never degrades another's service.
An honest note on certifications
We will never claim a compliance certification that isn't backed by the required controls and independent verification. Security controls are implemented in the product today; formal certification status for your deployment can be confirmed by your Click IT provider. Ask us for our current security documentation.
Want the full security documentation?
Talk to our team for architecture details, data-region options and compliance conversations.