Security
How Permenta is built and run
A compliance record is only worth what its custody is worth. These are the properties the service is built to, and how to reach us if you find something wrong.
The platform
Hosted in the EU
Workspaces run on Microsoft Azure in Sweden Central. Tenant data does not leave the EU for hosting.
Tenant isolation in the database
Every tenant table is protected by PostgreSQL row-level security, enforced for every role. A query without a tenant context sees no rows.
A separate realm for staff
Our staff sign into a separate portal with passkeys. Staff accounts live in their own tables, so no customer record can ever point at one.
Hash-chained ledgers
Evidence ledgers, report timelines and audit logs are append-only and hash-chained, so a missing or altered entry is detectable.
Encryption in transit and at rest
TLS 1.2 or later everywhere; storage and database volumes encrypted at rest; secrets in Azure Key Vault and never in code.
Least-privilege roles
The web app, background worker, staff portal and backups each connect with their own database role and only the rights they need.
Authentication built against account takeover
Passkeys, TOTP two-factor, breached-password checks, verified email, database-backed rate limits and session revocation.
Content security policy
A nonce-based CSP without inline script, HSTS, strict referrer and framing policies on every response.
Dependency scanning and supply chain
Pinned lockfiles, a release-age gate on new versions, dependency scanning, and our own SBOM published the way we ask you to publish yours.
SHA-pinned CI and reviewed deploys
Build actions are pinned to commits, images are built from clean checkouts and deployed through short-lived federated credentials.
Uploads treated as hostile
SBOMs are size-limited, parsed in an isolated worker with XML entities disabled, and stored under keys you never control.
Backups and recovery
Point-in-time recovery for the database, versioned object storage, and a restore drill that is part of the release checklist.
Coordinated vulnerability disclosure
If you believe you have found a security vulnerability in Permenta, please tell us before you tell anyone else. Write to security@permenta.com with enough detail to reproduce the issue. Our contact details are also published at /.well-known/security.txt (RFC 9116).
- We acknowledge reports within two business days and keep you informed while we work on a fix.
- We aim to fix critical issues within seven days and others within ninety, and we will tell you when the fix ships.
- We will not take legal action against research done in good faith: no data destruction, no access to data that is not yours, no denial of service, and no public disclosure before we have shipped a fix or ninety days have passed, whichever is first.
- We credit reporters who want to be credited. We do not run a paid bounty programme at this time.