Controls you can inspect, not vague assurances
This summary describes controls implemented in the current Timastra Collect codebase and the responsibilities that remain with each customer.
Identity and authorization
Private-site authentication supplies a stable signed-in user identity. Every product record is organization-scoped, every API route enforces authentication, and server-side permissions distinguish owner, administrator, finance manager, collector, and read-only roles. Ownership transfer and sensitive operations use explicit guards.
Data protection
Financial values use integer minor units. Connected-provider tokens and database recovery copies use versioned AES-GCM encryption with managed key rotation. Credentials are excluded from customer exports and redacted from audit and operational diagnostics. Production secrets are configured outside source control.
Integrity and recovery
Optimistic versions, idempotency records, database constraints, and atomic audit writes protect financial mutations. Audit and payment-plan history are immutable except during verified organization deletion. Encrypted backups have retention, freshness monitoring, integrity validation, and isolated restore drills.
Monitoring and incident response
Timastra Collect records redacted operational events, creates actionable alerts, monitors integration queues and backup freshness, and maintains a service-status channel. Suspected security incidents follow documented containment, evidence-preservation, assessment, recovery, and notification procedures. Report urgent concerns through Help & legal.
Shared responsibility
Customers control team membership, source-data accuracy, endpoint security, exported files, communication content, and lawful processing. Use least-privilege roles, remove former users promptly, do not share credentials, and report unexpected activity. A DPA, subprocessor description, control evidence, and security questionnaire response can be requested through the documented review process.
Current boundaries
External penetration testing, independent SOC 2 certification, provider-native backup contractual validation, and public incident paging are not claimed as complete. The private pilot should not be represented as certified until independent evidence exists.