Security Overview

Security Overview

Version: 1.4 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: quarterly

Purpose

This document is the public-facing summary of how Pocket PMO is secured. It is written for customers, partners, and their security teams. Contractual detail (SLA, breach notification, insurance) is available under NDA on request.

Scope

The Pocket PMO web application (pocketpmo.co.uk), its mobile shells (iOS and Android via Capacitor), the managed backend (managed Postgres and edge functions), and any integrations invoked from customer accounts.

Platform architecture (summary)

Pocket PMO is a React 18 single-page application, backed by a managed Postgres database (Lovable Cloud, built on Supabase) and Deno-based edge functions. AI features route through the Lovable AI Gateway. Payments are handled by Stripe. Transactional and authentication emails are sent through the Lovable-managed email pipeline (Resend). Microsoft 365 integrations use OAuth2 delegated auth via Microsoft Graph.

A fuller diagram is available in the Enterprise Architecture Overview.

Identity and access

• Authentication methods: email + password (with password strength rules and Have-I-Been-Pwned check), Google, Apple, SAML SSO on request, and TOTP MFA.
• Password policy: minimum 8 characters, upper- and lower-case letter, digit and symbol; leaked-password check enforced at the auth provider.
• Session management: 30-minute inactivity timeout with 5-minute warning; forced sign-out on expiry.
• Authorisation: role-based access enforced at the database with Row Level Security. Organisation membership and platform-level admin role are the only privilege boundaries. Roles are held in a dedicated user_roles table and evaluated by a SECURITY DEFINER function; roles are never stored on profile records.
• Shared report access: published snapshot reports are either restricted to named invited readers or open to anyone holding the link, at the publisher's choice; new reports default to invited-only. Invited readers verify a single-use 6-digit code emailed to them (15-minute expiry, six attempts, rate limited per address and per source); a verified browser holds an opaque token for 30 days. Codes and tokens are stored only as SHA-256 hashes in service-role-only tables, and revoking an invitee ends access immediately.
• Impersonation by platform admins is time-boxed, logged in admin_impersonation_sessions, and reason-required.

Data protection

• Encryption in transit: TLS 1.3 for all customer traffic on pocketpmo.co.uk and Lovable-managed subdomains.
• Encryption at rest: AES-256 at the managed Postgres storage layer, with key management operated by Lovable Cloud under its SOC 2 Type I and ISO/IEC 27001:2022 certified controls.
• Hosting: Lovable Cloud on Google Cloud Platform (Europe region), with AWS used by Lovable for object storage and AI runtime. See the Sub-Processor Register for the full upstream list.
• Tenant isolation: Row Level Security on every business table; organisation membership is the boundary. Every CREATE TABLE in the public schema is followed by explicit GRANT statements in the same migration, so RLS is not the only line of defence.
• Row Level Security coverage: every business table has RLS enabled. Policies are defined per action (select/insert/update/delete) and reviewed on migration.
• Backups: approximately 14 days of daily backups retained by Lovable Cloud, browsable and restorable.
• Point-in-time recovery (PITR) and detailed key-management (KMS) specifics: available under NDA on request from Lovable Cloud.

Operational security

• Audit trail: audit_logs and per-domain change tables (wip_change_log, project change history) record who did what, when. Audit log retention: 12 months.
• Rate limits and public-form validation: applied to authentication, public intake forms and AI endpoints. Public requests are length-limited, sanitised, checked against the named account and organisation, and rate-limited by source and account before being accepted; security events are recorded in rate_limits and failed_login_attempts.
• Security events: recorded in security_events.
• Secrets: never shipped to the browser; server-only environment variables managed in the hosting console. Rotated every 12 months and on any offboarding.
• Monitoring: application errors reported to Sentry when the DSN is configured; supported by managed database and edge-function logs.

AI safeguards

• All AI calls run inside edge functions with server-only credentials.
• Approval-first: AI suggestions are presented as [DRAFT] until a human explicitly commits them.
• AI users (agents) cannot be assigned tasks or work items.
• Model providers do not train on customer content. This is contractually excluded via the Lovable AI Gateway.

Incident response

Pocket PMO commits to notify affected customers of any confirmed personal-data breach without undue delay, and in any case within 72 hours of confirmation, in line with UK GDPR Article 33/34. Full detail is in the Incident Response Policy.

What we do not claim

• Pocket PMO Ltd is not itself certified to SOC 2 or ISO 27001 today; both are on the roadmap. Our upstream platform (Lovable Cloud) holds SOC 2 Type I and ISO/IEC 27001:2022.
• We do not publish a contractual uptime SLA in this document. Enterprise agreements can include one on request.

Document history