Row-level security
Every table with company data has PostgreSQL row-level security enabled and forced. A query only sees the rows of the session's company.
Security
Every company isolated in the database itself
logictra hosts companies that work together and companies that compete. That is why separation between them doesn't rely on the code remembering to filter: PostgreSQL enforces it on every query.
Isolation
Separation enforced by the database
Closed by default
If a query arrives without a company, it returns no rows. The application connects with a role that cannot bypass these rules.
Platform data kept apart
What belongs to the platform (tunnels, connection codes, aliases) lives in a schema that no company can read.
Traceability
Every change, with who, when and what
Chained audit log
Each audit record carries the fingerprint of the previous one. The database rejects an out-of-sequence record and the application cannot modify or delete historical records.
Three chains
One for each company's activity, one for security events (sign-ins and lockouts) and one for platform actions. The chains can be verified.
One request, one identifier
Each request gets a correlation identifier that travels with the audit log and the technical logs, end to end.
Access
Passwords, sessions and permissions
Passwords with argon2id
Passwords are stored with argon2id. Changing your password closes your other open sessions.
Sessions that expire
The session is kept in a cookie that page scripts cannot read and expires after 12 hours, or sooner if the company configures it. After five failed attempts the user is locked out for 15 minutes.
Server-side permissions
Every action checks the requester's permission on the server, with roles per company. The interface only hides what you can't use.
External service credentials
Your credentials, encrypted and with a usage log
AES-256-GCM encryption
Credentials for the Spanish Tax Agency, ShipsGo, Holded or your mail server are stored encrypted and only decrypted in memory during the call.
Rotation without overwriting
Rotating a credential creates a new version; only its last four characters are shown on screen.
Every use logged
Every call to a provider is logged. If a provider fails several times in a row, calls pause for a while so as not to make things worse.
Infrastructure
Where logictra runs
- The application runs on Vercel, in its Frankfurt (Germany) region.
- The database is PostgreSQL managed by Neon, in Frankfurt (Germany).
- The public website and the application live on separate domains, and the application asks search engines not to index it.
- Security headers limit the origins the page can load resources from and prevent it from being embedded in other sites.
Good to know
What isn't there yet
- Two-step verification (MFA) is not available yet.
- logictra holds no certifications such as ISO 27001 or the Spanish National Security Framework (ENS).
Frequently asked questions
Security questions
Can logictra staff see my data?
Platform staff have an administration panel to provide support. Their actions are recorded in the platform's audit log.
How do I report a security issue?
Write to us with the subject «Security». The Report a vulnerability page has the guidelines and what we will do.
Review security with your technical team
If you need more detail for a supplier assessment, ask and we'll go through it together.