Security & complianceDOC-SEC-001 · REV 4 · 24 July 2026
Written for your IT director
and your city attorney.
This page states our posture in the form procurement asks for it — mechanisms, not adjectives. Where we hold a certification we name it. Where we do not, we say so and give the date we expect to.
Section 1
Tenant isolation
Every row of permit data carries its jurisdiction, and the database itself refuses to return rows belonging to another one. The policy is evaluated by PostgreSQL row-level security on every query, under a role that cannot bypass it.
Why the distinction matters. Most multi-tenant systems filter by tenant in application code — a WHERE clause a developer must remember to write. One missing clause in one endpoint exposes another city's records. When the rule lives in the database, a forgotten clause returns nothing rather than someone else's data.
| Layer | Mechanism | What it prevents |
|---|---|---|
| Database | Row-level security policies on every tenant-scoped table; app role has no BYPASSRLS. | Cross-tenant reads and writes, including via a coding error or SQL injection. |
| Session | Tenant claim set from the authenticated session, never from a request parameter. | Tenant switching by tampering with a URL, header, or form field. |
| Documents | Object storage keyed by tenant; access only through short-lived signed URLs. | Drawing sets or permits reachable by guessing a storage path. |
| Backups | Per-tenant logical export in addition to encrypted full-cluster snapshots. | A restore for one city exposing or overwriting another city's data. |
Section 2
Identity & access
Staff authenticate through your identity provider. Applicants hold their own PermitFoundry account, which works in every jurisdiction on the platform — the two are separate identity domains and are never merged.
Staff identity
- SAML 2.0 and OpenID Connect against Entra ID, Okta, Google Workspace, or any conformant IdP.
- SCIM 2.0 provisioning and deprovisioning, so a departing employee loses access when HR closes the account.
- MFA enforced by your IdP; we do not ask you to maintain a second factor in our system.
- Session length, idle timeout, and IP allowlisting configurable per jurisdiction.
Applicant identity
- One account across jurisdictions, with email, social, or passkey sign-in and optional MFA.
- Delegated authority: a client grants an expediter or contractor scoped access per project, revocable, fully logged.
- Public status lookup requires no account and exposes only what your ordinance makes public.
- Applicant accounts can never be granted staff permissions, in any tenant.
| Permission layer | Decides | Example |
|---|---|---|
| Role-based | What a job title may ever do. | Only a Building Official role may issue a permit. |
| Attribute-based | Which records that role touches, from record attributes. | A Fire reviewer sees Fire review items on any case, not Zoning's. |
| Delegated | Per-record grants made by the record's owner, with an expiry. | A homeowner lets a contractor respond to corrections on one permit. |
Section 3
Encryption
| State | Protection | Key management |
|---|---|---|
| In transit | TLS 1.3 (1.2 floor), HSTS, no mixed content; internal service traffic also encrypted. | Managed certificates, automatic rotation. |
| At rest | AES-256 on database volumes, object storage, and backups. | Cloud KMS, annual rotation, separated duties. |
| In use | Field-level encryption for the small set of sensitive fields (payment references, contact records under a confidentiality flag). | Separate key, access logged per read. |
Card payments are handled by a PCI-DSS Level 1 processor. Card numbers never reach our systems; we store a processor reference and the amount.
Section 4 · checkable claim
Audit trail & tamper evidence
Every state change is an append-only entry whose hash includes the hash of the entry before it. Altering or deleting history breaks the chain at that point and every point after it, which a verification pass detects. Ask your incumbent vendor to demonstrate the same thing.
ENTRY 0412
Fire review comment added · reviewer R-118
prev 9f2c…a71bhash 41d8…c0e5
ENTRY 0413
Correction letter issued · clock paused
prev 41d8…c0e5hash b73a…19f4
ENTRY 0414
Rev 3 received · clock resumed, 18 d remain
prev b73a…19f4hash 6e01…8d2c
Chain verified · 412,880 entriesVerification runs nightly and on demand; the result is available to your auditor.
Point-in-time reconstruction
Give us a permit and a date and we render the record exactly as it stood then — status, documents in file, comments outstanding, clock position. This is what an appeal, a public-records request, or a litigation hold actually asks for, and several legacy systems cannot produce it.
What is logged
Reads of confidential records as well as writes: who viewed, who exported, who changed a fee, who overrode a clock, who granted access to whom, with actor, timestamp, and prior value. Staff cannot delete audit entries; neither can we.
Section 5
Accessibility
WCAG 2.2 AA across the applicant portal, the staff portal, the public pages, and this website. The VPAT is published rather than furnished on request, and it names its own exceptions.
The DOJ web accessibility rule under ADA Title II sets compliance deadlines in 2027 and 2028 depending on population. For most jurisdictions this has already moved accessibility from a nicety to a scored RFP line — and a permitting portal is squarely in scope, because it is how residents transact with the city.
VPAT 2.5 · published
Section 508, WCAG 2.2 AA, and EN 301 549 columns completed, with exceptions listed.
Third-party audit
Independent audit and assistive-technology testing; report available under NDA during procurement.
No color-only meaning
Every status, clock state, and severity pairs colour with a text label. The product works in grayscale.
Section 6
Privacy & records
Permit records are public records, and the interesting problem is not privacy in general but which fields your state exempts. The system treats that as configuration, per jurisdiction.
Records requests
Assemble the responsive file from the case, apply your redaction rules, and log what was released, to whom, and when. Statutory response clocks are tracked the same way review clocks are.
Retention & disposition
Your retention schedule is configured per record type and applied automatically at closeout, including permanent retention for the classes your state requires to be kept permanently.
Confidential fields
Exempt data — address confidentiality programs, certain plans for critical infrastructure — is flagged per field, withheld from public views, and its reads are logged individually.
Your data is yours
Structured export plus original documents at any time, during the term and at exit. No export fee, no retention of your records for our own purposes, no training of models on your data.
Section 7
Compliance roadmap
Stated as a dated sequence, because "SOC 2 in progress" on a vendor website means nothing you can score. Held, in progress, and planned are three different words and we use them precisely.
| Item | Status | Detail |
|---|---|---|
| WCAG 2.2 AA + VPAT | Held now | Published, with named exceptions. Re-audited on each major release. |
| Penetration test | Held now | Annual third-party test; summary letter and remediation status shared during procurement. |
| SOC 2 Type II | In progress | Observation window opened Q2 2026; report expected Q1 2027. We do not claim it before the report exists. |
| StateRAMP / GovRAMP | Planned · dated | Ready status targeted H2 2027, authorized H1 2028, following SOC 2. Sponsorship discussions with two states. |
| CJIS / IRS 1075 | Not applicable | Permitting does not process criminal justice or federal tax information. We will say so in your RFP rather than claim scope we do not have. |
What we do not claim
We are not FedRAMP authorized, not StateRAMP authorized today, and not SOC 2 certified today. Any vendor page that implies a certification without naming the report date and auditor is doing something we would rather not do — and the credibility of everything else on this page depends on that restraint.
Send this to your IT director as a document.
The security summary is the same content as this page, formatted for an RFP attachment, with the VPAT and the network diagram included. No form, no email address, no sales follow-up.
The security summary PDF and VPAT 2.5 are published on request while the download links are being finalised.