Security

Security at FORTE/CYBERx

FORTE/CYBERx is built by cybersecurity practitioners for cybersecurity leaders. Security is the product — these are the controls that back it.

Encryption

TLS 1.3 in transit. AES-256 at rest via Supabase managed Postgres and storage. Secrets stored in Supabase Vault, never in code.

Authentication

Email-OTP sign-in with PKCE flow. Optional TOTP-based MFA via Supabase. Session assurance levels gate sensitive actions.

Authorisation

Row-Level Security on every table. Role-based admin access, scoped via a separate warroom_admins table — never client-trusted.

Hosting

Application served via a managed cloud edge. Database, auth, storage, and edge functions on Supabase, Sydney ap-southeast-2.

Data residency

Customer data resides in Australia. Backups (Supabase PITR) are also stored in-region.

AI processing

Mission inputs are sent to Google Gemini and OpenAI for inference. Providers are contractually instructed not to train foundation models on customer data.

Logging & audit

Mission audit log per session. Application-level security_audit_log for authentication, MFA, and admin events. Per-route rate limiting on edge functions.

Backups

Supabase Point-in-Time Recovery with up to 7-day window. Disaster-recovery runbook tested quarterly.

Incident response

Email security@fortecyberx.au for confidential disclosure. We acknowledge within 24 hours and triage within 72.

Responsible disclosure

We welcome reports from the security community. Test only against accounts you own, avoid disrupting other customers, and give us a reasonable window to remediate before public disclosure. We will publicly acknowledge contributors who follow this process.