Security
Every company on Chantro is walled off from every other, in the application and in the database itself. Here is how, in plain words.
01What protects your data
Facts we can point to, with links to the full text at the end of the page.
Row-level security is enforced in the database on the tables that hold company data. Even if an application check were skipped, the database would still refuse another company's rows.
Six built-in roles, from owner to worker, with permissions you can tailor per position in the org chart.
People can turn on two-step sign-in with an authenticator app, and keep backup codes. Sign in with a password, or with Google or Microsoft where they are set up.
Security-relevant events are recorded in an audit trail the app can only add to: permission changes, membership changes, exports and deletions. Significant AI actions are logged too.
Support access is something someone in your company grants, for a limited time, and it never goes beyond that person's own access. It is read-only unless they choose read and write, and every change is logged. You turn it on in Settings, under Support.
Chantro runs on AWS in the United States. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256.
02Defense in depth
Keeping companies apart does not rest on a single check. Each layer works even if another is bypassed.
Layer 01
Every request is signed in, bound to one workspace, and refused if it reaches for another company's data.
Layer 02
Row-level security sets the company for every query. The database hands back only that company's rows.
Layer 03
Uploads live in per-company folders and are served through short-lived, scoped links.
03The small things
Files are checked for size and type before they are accepted, and files the AI reads are also checked for their actual contents.
New accounts pass a bot check, and authentication endpoints are rate limited.
An invite link works once and expires after seven days.
A person can belong to several companies, and each one stays a separate workspace.
Error reporting removes personal details before anything leaves the app.
Researchers can report a vulnerability by email, and we ask for reasonable time to fix it.
04The full text
The legal pages are the source for everything above, including what is in place today and what is still on our roadmap.
We do not list certifications we do not hold. To report a vulnerability, write to security@chantro.com.
Talk to us. We will answer plainly, and point to the page that says it.
Row-level security in the database keeps each company's rows apart, and data is encrypted in transit and at rest.
