Trust · Security
Security, as built into phaf.
phaf runs on your own infrastructure. This page lists the security controls the product has today — nothing more.
- 01Installed by you
- 02Your data stays with you
- 03No access from Spectro
Hosting
Your servers. Your data.
01
Installed by you
phaf is installed on your servers or in your private cloud (Windows Server). It is not a SaaS service.
02
Your data stays with you
Files, messages, logs and credentials are kept on your servers and in your application database (SQLite or SQL Server).
03
No access from Spectro
Spectro Web Solutions has no access to your installation and phaf sends no telemetry. We only see what you choose to share with support.
Controls
What the product does.
In transit
- FTPS uses TLS 1.2 or 1.3 by default.
- SFTP connections run over SSH, with password or key authentication.
- Email alerts are sent over SMTP with TLS 1.2 as the minimum version.
- SQL Server connections support TLS encryption and server certificate validation.
- The web console is published over HTTPS (TLS 1.2+) through your reverse proxy, such as IIS or nginx.
At rest
- Passwords, keys and other secrets are encrypted with AES-256-GCM.
- The master key is generated on your server and never leaves it.
- Secrets are never shown again after saving — connectors only reference them.
- User passwords are stored as salted scrypt hashes, never in clear text.
- Message files sit on your disks: protect them with your disk or volume encryption (for example BitLocker).
Access control
- Role-based access with four roles: administrator, standard (edits flows), support and user (view only).
- Two-factor authentication (TOTP), optional or mandatory for all users.
- Password policy: length, complexity, expiry, reuse and disabling of inactive accounts.
- Account lockout after repeated failed logins, and sessions that expire.
- Allowed and blocked IP lists for the console, the Admin API and the Flow API.
- API tokens with expiry dates, which can be revoked or regenerated.
Audit and monitoring
- Audit log of logins, two-factor changes, password changes, and every create, update and delete.
- Each entry records who, what, when, from which IP address, and the result.
- Audit events can be forwarded to your SIEM over syslog (UDP or TCP, CEF format).
- A full trail for every message: status, logs and the files themselves.
- Email alerts on errors and before certificates expire.
Protocols
Supported protocols and their encryption.
| Protocol | Encryption | Notes |
|---|---|---|
| SFTP | SSH | Password or key authentication. Client connections to partner servers. |
| FTPS | TLS 1.2 / 1.3 | Explicit or implicit TLS. Older TLS versions only if you enable them for a legacy partner. |
| FTP | None | Unencrypted. Use only inside trusted networks or when a partner offers nothing else. |
| SMB / network folders | Windows (SMB) | Encryption and access as configured on your Windows file server. |
| SQL Server | TLS (TDS) | Turn on encryption and certificate validation for each connection. |
| SMTP (alerts) | TLS 1.2+ | STARTTLS or implicit TLS to your mail server. |
| Web console and APIs | HTTPS via reverse proxy | TLS ends at your IIS or nginx, with your own certificate. |
Good practice
We follow ISO 27001 and CIS good practices in these controls.
Only where we can show the control working in the product. This is not a certification.
| Area | How phaf covers it |
|---|---|
| Access control | Roles, least privilege, two-factor authentication, password policy, account lockout. |
| Cryptography | AES-256-GCM for secrets, scrypt for passwords, TLS 1.2+ for outbound FTPS and SMTP. |
| Logging and monitoring | Audit log with user, IP and result; syslog export in CEF. |
| Secure configuration | Security headers in the web console (CSP, X-Frame-Options, nosniff), HttpOnly and SameSite cookies, CSRF protection. |
| Secrets management | Credentials are never shown again and can be shared between connectors and rotated in one place. |
| Network restrictions | IP allow and block lists per resource and per user. |
Privacy
GDPR.
phaf helps you meet your obligations
You decide what personal data flows through phaf, where it is stored and for how long. Access control, the audit log and the message trail help you show who accessed what.
Data processing agreement
A data processing agreement (DPA) is available on request for customers who share data with us during support.
Data location
Because phaf runs on your infrastructure, your data stays in the country and data center you choose.
Certifications
Where we stand.
phaf does not currently hold SOC 2, ISO 27001, FIPS 140 or Drummond certification. When we obtain a certification, we will publish it here.
Your part
Recommended setup on your side
- Publish the web console only over HTTPS, through a reverse proxy.
- Turn on encryption and certificate validation on SQL Server connections.
- Encrypt the disks that hold message files and the application database.
- Restrict access to the folder that holds the master key and back it up safely.
- Keep the operating system and phaf up to date.
Requests
DPA, security questionnaire or a vulnerability.
Ask for our data processing agreement or our answers to your security questionnaire. To report a vulnerability, choose that topic and do not include exploit details until we reply.