Security

Security at GiesenCloud

GiesenCloud is the operational platform that runs alongside Giesen coffee roasters worldwide. We take the security of your roasting data, your customers' personal data, and your team's accounts seriously. This page is a transparent overview of how we protect that information.

Architecture & isolation

Multi-tenant isolation: Every customer is a team. Customer data is scoped to team_id at the query layer enforced by a three-layer authorization model. There is no path by which one customer can read another customer’s data.
Production hosting: Cloud-hosted with the provider’s SOC 2 / ISO 27001 attestation. Hosted in the EU (Frankfurt, eu-central-1).; pending — provider attestation to be linked once published
Network: TLS 1.2+ everywhere; HSTS preloaded; edge bot protection via Cloudflare Turnstile; security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).

Authentication & access

Two-factor authentication: TOTP-based 2FA available to every user; required for Giesen staff with production access.
Password policy: Minimum 8 characters, mixed case, numbers, symbols, screened against the Have I Been Pwned breach corpus.
Role-based access: Nine preset roles (Owner, Manager, Head Roaster, Roaster, Inventory Manager, Sales/ERP, QC Manager, Viewer, Partner User) plus custom roles, built on fine-grained permissions across profiling, inventory, ERP, quality, reports and team management.
Privileged staff access: IP-restricted to office / VPN ranges; 2FA mandatory; quarterly access reviews.

Encryption

In transit: TLS 1.2+ from browser, mobile app, or roaster.
At rest: Database and object-storage encryption by the hosting provider; SSE-S3 on AWS S3.
Application layer: Sensitive values (Shopify OAuth token, per-team integration credentials, 2FA secrets) stored with Laravel’s encrypted cast.
Passwords: Bcrypt-hashed; never stored in plaintext; never logged.

Logging, monitoring, audit

Activity log: Account, team, and role changes are recorded with actor, timestamp, and changed fields. Retained 365 days. Audit coverage is being extended to roasting and ERP data.
Authentication log: Every login attempt (success and failure) recorded with IP and user agent.
Error tracking: Application errors sent to Sentry with PII redacted at the SDK level. Used only for fixing defects.
Application monitoring: Aggregate request and query timing via Sentry; queue monitoring via Horizon.

Software development

Pull-request review: All code changes go through PR review before production. No direct pushes.
CODEOWNERS: Additional review enforced on changes to authentication, authorization, middleware, public API, and policies.
CI gates: Linter (Pint), secret scanning (Gitleaks), translation parity, frontend build, frontend tests (Vitest), smoke tests (Playwright) — all blocking on merge.
Dependency hygiene: Lockfiles committed; composer audit runs on every pull request; Dependabot opens dependency updates weekly.

Business continuity & backup

Database backups: Continuous WAL archiving plus nightly snapshots, retained 35 days for point-in-time recovery.; specifics to be confirmed with hosting provider
Restore drills: Restore drills and an annual disaster-recovery exercise are being established, with the first drill planned for Q4 2026.
Multi-AZ: Application infrastructure runs across multiple availability zones.

Incident response

Documented process: Four severity levels with defined response-time targets; on-call rotation; named incident commander.
Customer notification: Confirmed customer-data breach: notification without undue delay, target within 24 hours for critical breaches.
Regulatory notification: 72-hour notification to the Autoriteit Persoonsgegevens for personal data breaches per GDPR Art. 33.

Vulnerability disclosure

Reporting: security@giesen.com — see the Contact page for our full disclosure terms.
Acknowledgement: Within 48 hours; initial assessment within 7 days; public credit (with permission) on resolution.
Safe-harbor: We will not pursue legal action against good-faith researchers operating within our disclosure terms.

Report a vulnerability: security@giesen.com

All security and privacy contacts