Authentication
Secure sign-in and multi-factor authentication capabilities form part of product development. Authentication requirements are reviewed for each deployment and user role.
OUR SECURITY APPROACH
Security Is a Design Requirement.
Access controls, private records and responsible infrastructure operations are fundamental to public-sector software.
Security Built Into the Architecture.
These principles guide development and validation. Implementation and operating controls must be verified for each product and environment.
Authorization
Role-based permissions are designed to control access to records and actions. Authorization must be enforced at application boundaries, including private documents.
Data Protection
Encrypted connections and provider storage controls are part of the architecture. Data handling and retention requirements must be defined for each service and deployment.
Private Documents
Private files require controlled access rather than public asset URLs. Native storage, access checks and link behavior are subjects of continuing validation.
Infrastructure Access
Provider access is scoped to the permissions needed for operations. Infrastructure credentials belong in protected configuration rather than public client code.
Environment Separation
Development and validation environments are separated from customer operating environments. Configuration and permissions should reflect the purpose of each environment.
Auditability
Product and operational history support traceability. Records should make it possible to understand relevant actions and changes.
Release Integrity
Immutable artifact concepts support a release process that promotes tested code rather than rebuilding an unverified variation at each stage.
Cloud Security
Cloud-provider adapters preserve application boundaries. Canadian deployment and residency considerations are assessed against the chosen provider, region and service configuration.
Operational Controls
Backup, recovery, observability and incident-response planning are part of preparing products for operation. Plans need to be tested before assurances are made.
Responsible Development
Security claims should follow evidence. Development status, validation limits and unresolved requirements should remain visible.
SECURITY & COMPLIANCE ROADMAP
Evidence Before Assurance.
Formal certifications and compliance programs may be pursued as the company matures. Municipal Centre does not currently claim SOC 2, ISO 27001, FedRAMP, PCI certification or government security certification.
Continuing work includes native access-control validation, backup and recovery planning, operational monitoring, security review and deployment-specific documentation.
Discuss Security Requirements