Password storage
Passwords continue to use the application’s established secure password hashing rather than being stored as plaintext.
Security
Confirmed access and deployment controls
This overview describes controls present in the released application and static-site architecture. It does not claim certifications or compliance status.
Application controls
Security statements limited to implemented behaviour
Role-based project access
Project membership and roles determine who can view or change review work, with separate administrator controls.
Session-based authentication
The application uses authenticated browser sessions. Password reset and selected administrative actions invalidate older sessions through session versioning.
HTTPS in production
The production deployment is configured for secure cookies and HTTPS-based public application URLs.
Private application indexing
Application HTML responses include noindex and nofollow instructions, and the app-domain robots file disallows crawling.
Optional email verification
When enabled by an administrator, new users verify their email through expiring, single-use tokens stored only as hashes.
Administrator controls
Administrators manage users, projects, files and application settings through the protected administration workspace.
Separate public site
The marketing site is static, has no application API connection and contains no authenticated project information.
No certification claim: SystematiCat does not use this page to claim a security certification, regulatory compliance status or encryption capability that has not been implemented and verified.
Authenticated application