Security
Security at FORTE/CYBERx
FORTE/CYBERx is built by cybersecurity practitioners for cybersecurity leaders. Security is the product — these are the controls that back it.
Encryption
TLS 1.3 in transit. AES-256 at rest via Supabase managed Postgres and storage. Secrets stored in Supabase Vault, never in code.
Authentication
Email-OTP sign-in with PKCE flow. Optional TOTP-based MFA via Supabase. Session assurance levels gate sensitive actions.
Authorisation
Row-Level Security on every table. Role-based admin access, scoped via a separate
warroom_admins table — never client-trusted.Hosting
Application served via a managed cloud edge. Database, auth, storage, and edge functions on Supabase, Sydney
ap-southeast-2.Data residency
Customer data resides in Australia. Backups (Supabase PITR) are also stored in-region.
AI processing
Mission inputs are sent to Google Gemini and OpenAI for inference. Providers are contractually instructed not to train foundation models on customer data.
Logging & audit
Mission audit log per session. Application-level
security_audit_log for authentication, MFA, and admin events. Per-route rate limiting on edge functions.Backups
Supabase Point-in-Time Recovery with up to 7-day window. Disaster-recovery runbook tested quarterly.
Incident response
Email security@fortecyberx.au for confidential disclosure. We acknowledge within 24 hours and triage within 72.
Responsible disclosure
We welcome reports from the security community. Test only against accounts you own, avoid disrupting other customers, and give us a reasonable window to remediate before public disclosure. We will publicly acknowledge contributors who follow this process.