Security is the first feature.
Your inventory lists every device, person and system in your company. Here is how we keep it yours: separated from every other customer, limited to the right people inside your company, and recorded at every step.
Separate by design, checked in every layer.
No single check stands between your data and another customer. Each layer works on its own and refuses access when in doubt, so a mistake in one is caught by the next.
Your workspace is its address
Your workspace is identified only by its address, such as yourcompany.acetflo.com, never by anything a request claims about itself.
Credentials work in one workspace only
Sessions, API tokens, service accounts and SCIM tokens all belong to one workspace. Presented anywhere else, they're rejected and the attempt is recorded in your audit log.
The database enforces the boundary
PostgreSQL row-level security limits every query to your workspace. The application connects with a role that can't switch it off, and with no workspace set, a query returns nothing.
Records can't point across workspaces
Links between records, such as a device's owner or location, must stay inside the same workspace. The database rejects anything else.
Identities are per workspace
The same email address in two companies means two unrelated accounts. Single sign-on and SCIM only ever create users in their own workspace.
Background work follows the same rules
Syncs, automations, webhooks and SIEM delivery run inside your workspace's boundary too. Two companies with identical serial numbers keep two separate devices.
A key for each workspace
Integration, single sign-on and SIEM secrets are encrypted with your workspace's own key. When you leave, that key is destroyed.
Attacked before every release
Our automated tests call every API route with another customer's credentials and record IDs, check the database rules directly, and block the release if anything gets through.
The right access for every person.
Being inside your workspace isn't the same as seeing everything in it.
- Roles built from permissions, scoped to locations, departments and asset types. Scopes apply to lists, search, dashboards, exports and bulk actions.
- Sensitive fields hidden: financial and personal data only for roles that need it.
- No self-escalation and protection for the last owner, so nobody can lock you out or grant themselves more.
- API tokens and service accounts can never do more than the person who created them.
- Single sign-on with OIDC or SAML 2.0, SCIM provisioning, and a local break-glass owner.
Every action, on the record.
Changes, sign-ins, denied requests, exports and sensitive reads are recorded together with the change itself.
- Tamper-evident: each entry is chained to the one before it, and the database only allows appending.
- Streamed to your SIEM over syslog with TLS, HTTPS, Splunk, Microsoft Sentinel, Datadog, Elastic or OpenSearch, or S3.
- Cross-workspace attempts appear in your log, so you can see them too.
Hosted in the EU, built to recover.
EU hosting
Acetflo Cloud runs on Scaleway in Paris, France. Backups are copied to Amsterdam for disaster recovery.
Encryption
TLS for every connection, with HSTS. The database is encrypted at rest, secrets are encrypted again with your workspace key, and passwords are stored only as salted scrypt hashes.
Recovery
Managed PostgreSQL with high availability and point-in-time recovery. Updates roll out without downtime, and database changes are checked so a rollback stays safe.
Signed releases
Every release is a signed container image with a software bill of materials. Images with known high or critical vulnerabilities don't ship.
Internal tools stay internal
Administrative interfaces aren't reachable from the internet, and the application image contains no package managers or tools it doesn't need.
When you leave
On request we export your complete workspace. After a 30-day grace period your data is deleted and your workspace key destroyed.
Found something? Tell us.
Email security@acetflo.com with the details. We'll confirm we've received it, keep you updated while we fix it, and credit you if you'd like. Please don't access other customers' data or disrupt the service while testing. Our security.txt has the same details.