Security overview

Protection at the company boundary.

Aquino Command is designed so visual access controls are backed by server-side authorisation, company-scoped persistence and visible integration health.

Identity and membership

Authentication identifies the signed-in person. Membership separately determines which company they may access; the role determines which operations they may perform. Accounts are individual and should not be shared.

Tenant isolation

Operational queries include the verified workspace identifier. Unknown or unauthorised workspace identifiers are rejected before data operations run. Platform-owner functions are separately restricted.

Invitations

Invitation secrets are generated with cryptographically secure randomness, stored only as hashes, expire after seven days, rotate when resent and can be revoked. Acceptance requires the invited email account.

Connected services

Google OAuth tokens and company webhook secrets are encrypted using a server-held key. Tokens are not returned to browsers or included in company exports. Gmail is read-only and imports only messages matching the approved company rule. Website events require a company-specific HMAC signature.

Monitoring and auditability

Integration failures and last successful sync times are visible in the workspace. Security-sensitive actions create audit records. A protected server endpoint supports scheduled Gmail checks without exposing customer credentials.

Data recovery

Workspace owners can download a portable company-data export. Infrastructure backups and restore drills are governed by the production operations runbook; a restore is not described as verified until the operator records a successful drill.

Incident response

Suspected unauthorised access or exposed customer data follows the support and incident process: contain, preserve evidence, assess affected data, communicate with the customer controller without undue delay and document recovery and prevention actions.

Shared responsibility

Aquino protects the hosted service. Customers remain responsible for authorised users, secure devices, correct Gmail and website configuration, lawful customer communications and checking the original source when the dashboard reports a connection problem.