STATIQ security overview

Version 1.0 (draft) · Owner: JIWA HOLDING AS

Architecture and access

Multi-tenant database with row-level security (RLS) on every table, enforced even for the owner; the workspace is always derived from the signed-in identity, never from the client.
All writes use narrow, tested command functions with explicit access control and REVOKE for client roles on everything private.
Platform support requires MFA (aal2) and an explicit, time-limited access grant for each workspace; all such actions are audited.

TLS 1.2+ everywhere; HSTS and strict security headers (CSP, frame-ancestors, referrer-policy).
Encrypted local database on iOS (SQLCipher) with the key in Keychain.
Reports are stored in private object storage; shared links are random 256-bit tokens stored only as SHA-256 hashes, expire (7/30 days), can be revoked, are rate-limited and are never indexed.

The event log is append-only; corrections are new events. Every mutating call requires an idempotency key; payment provider webhooks are cryptographically verified and processed idempotently with tolerance for out-of-order delivery.
Reports are deterministic: the same log produces byte-identical PDF/CSV/JSON.

Structured logs with mandatory redaction of email addresses, tokens, names and bodies; request IDs for correlation. Technical logs: 30 days (90 for redacted errors).
Health endpoint and operational metrics without player names; alert thresholds are documented.

Secrets live only in providers' secret stores, never in code, files or logs (automatic CI scanning). No admin/service client in routine code (architecture guard).
CI runs lint, type checks, unit, database (pgTAP) and end-to-end tests, including cross-workspace access tests that never reveal whether data exists.
A local recovery drill is documented. Recovery using the selected production backup setup remains unverified. The drill is repeated before each gate acceptance and after migrations that change triggers or append-only protections.

Report security findings to support@statiqsport.com. We acknowledge receipt within 2 business days and do not publish findings before they are fixed.