Encrypted sensitive evidence
Monitoring evidence envelopes, provider attempts, and stored integration secrets use authenticated encryption before they cross their protected storage boundaries.
security
Security at Reconify
Financial event evidence is sensitive. This page describes controls verified in the product and deployment documentation. It is not a certification or contractual assurance statement.
cloud platform security
Security controls for the Reconify cloud platform
These practices are grounded in the current application, public API, worker, and deployment paths. Enterprise requirements are reviewed separately rather than implied here.
Encryption in transit
Production deployment guidance requires HTTPS for the dashboard and API. Outbound custom integrations and webhooks also require HTTPS and reject unsafe destinations.
Access control
Workspace roles and organization-scoped queries limit access to monitoring operations, findings, integrations, and reconciliation records within the active organization.
Authentication
Reconify supports verified-email account flows and standards-compliant OIDC token verification. Identity-provider MFA and session policy remain part of your identity configuration.
Data isolation
Public credentials, monitoring receipts, operations, findings, targets, and reconciliation queries carry an organization identity and enforce it at application boundaries.
Audit logging
Finding activity and investigation notes are append-only in the supported workflows. Plan evidence history is 30 days for Team, one year for Business, and defined by support policy for Enterprise.
Vulnerability management
The quality gate scans Go and JavaScript dependencies, container builds, and repository history. Report suspected vulnerabilities through the Responsible Disclosure process.
Incident response
Security events are handled through an incident process and applicable notification obligations. Contractual response or notification terms must be stated in the relevant agreement.
infrastructure
Infrastructure and availability
Managed and self-hosted deployments have different operational responsibilities.
Cloud hosting
The managed SaaS is deployed through the repository’s documented Railway architecture. Infrastructure details that form part of a customer commitment must be defined in the applicable agreement.
Backups and recovery
Backup frequency and recovery commitments for the managed service are defined only in an applicable agreement. Self-hosted operators are responsible for backing up PostgreSQL data, uploaded files, certificates, and any external evidence storage they configure.
Monitoring and uptime
Public service state is available through the Reconify status page. A formal availability commitment exists only when it is written into a customer agreement.
Employee access
Managed-service access is used for service operation, security, and authorized support. Customer-specific access restrictions or review requirements must be agreed before production use.
self-hosted deployment
Shared responsibility for self-hosted deployments
The documented Docker Compose deployment puts infrastructure and operational controls in your environment.
Reconify provides the application code, container definitions, security guidance, and update path. Your agreement determines the support available for that deployment.
You are responsible for the security of your deployment environment, which includes:
- Network access controls and firewall rules governing who can reach the Reconify API and database.
- Identity and authentication configuration, including the OIDC provider, MFA enforcement, and session policies.
- Encryption configuration for your storage layer, including key management and rotation.
- Log collection, retention, and any SIEM integration for your environment.
- Patch cadence for applying Reconify software updates to stay current with security releases.
- Physical and hypervisor-level security for any on-premises infrastructure.
Security review, deployment guidance, and support terms are available only when included in the applicable agreement.
To report a security issue or ask about security for an Enterprise deployment, contact us at kolawole@reconifyhq.com. Reports are handled under our Responsible Disclosure process.