Skip to main content
hitak
Notify me at launch

Security

An explicit boundary at every level.

hitak security relies on complementary application and PostgreSQL controls, opaque sessions and a delivery pipeline with blocking gates.

Notify me at launch Request a demo
A request journey
  1. Host identified · app.hitak.io
  2. Opaque, host-specific session
  3. Organisation revalidated
  4. PostgreSQL policy applied
  5. Organisation data only

Principles

Three boundaries, checked in depth.

Surfaces

Separate surfaces and sessions

The marketing site has no session. The client platform and administration use separate hosts and sessions.
  • Session-free marketing site
  • Separate hosts and sessions for platform and administration
hitak.io Marketing site no session
app.hitak.io Client platform dedicated session
admin.hitak.io Administration separate session

Organisations

Isolation by Organisation

The Organisation context is revalidated and tenant relationships are protected in depth by PostgreSQL policies.
  • Context revalidated on every request
  • PostgreSQL policies per Organisation
Organisation A Brand 1 Brand 2
Organisation B Brand 3 Brand 4

PostgreSQL isolation Separate sessions per surface Context revalidated on every request

Deliveries

Controlled deliveries

Formatting, tests, contracts, security scans, browser journeys, image and migrations block delivery on failure.
Delivery pipeline
  1. Formatting blocking
  2. Tests blocking
  3. Contracts blocking
  4. Security scans blocking
  5. Browser journeys blocking
  6. Image blocking
  7. Migrations blocking

Delivery authorised