# Security at Cablefolio

> Network documentation holds the keys to your clients’ networks, so Cablefolio treats it that way: encrypted credentials, server-side sessions, multi-factor sign-in, an audit log of every sensitive action, and continuous backups.

## Where your data lives

Cablefolio runs on Cloudflare’s platform: Workers for the application, D1 for the database, and R2 for photos and files, all encrypted at rest by Cloudflare. Every connection is HTTPS, and browsers are told to use nothing else (HSTS). Each organisation’s data is kept apart from every other organisation’s in every query.

## Signing in

- Passwords are stored only as salted PBKDF2-SHA256 hashes and compared in constant time. A password needs at least twelve characters and is checked against common choices.
- Repeated failures pause the account and the network they come from.
- Any account can add an authenticator app as a second factor, with one-time recovery codes.
- Sessions are rows on the server, named by a signed, HttpOnly, Secure, SameSite=Strict cookie. A session ends after seven days idle or thirty days at most, can be ended from the security page per device, and a password change ends the others.

## Credentials and secrets

Device logins, property access codes, and client vault entries are sealed with AES-256-GCM, each bound to its own record. Plaintext leaves the server only through an explicit reveal by an owner or admin, and every reveal is audited. No list, search result, export, report, offline copy, or log ever carries a credential. API tokens are stored only as hashes, and share and one-time links only as hashes of their secrets.

## Accountability

Every sign-in, failure, lockout, session revocation, password change, account change, export, and credential reveal is written to an audit log the application never edits or deletes. Managers can filter it, export it, and run an exposure report of every credential one account has revealed.

## Backups and recovery

The database is backed up continuously with Cloudflare D1 Time Travel, which can restore it to any minute of the last thirty days. Photos and files are stored in Cloudflare R2, which is designed for eleven nines of annual durability. You can also download a full export of your documentation at any time.

## Certifications, labelled honestly

Cablefolio runs on Cloudflare, which holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27018, and SOC 2 Type II, among others; see Cloudflare’s [compliance resources](https://www.cloudflare.com/trust-hub/compliance-resources/). Those are Cloudflare’s certifications for its platform, not Cablefolio’s. Cablefolio has not been audited for SOC 2 itself yet, and this page will say so until it has.

## Your data leaves with you

Export everything at any time: the whole documentation as JSON, every table as CSV or Excel, and reports as PDF or Word. There is no contract and no exit fee. See [importing and exporting](https://cablefolio.com/help/importing/).

## How the software is built

Every request is validated against strict schemas; every page carries a strict Content-Security-Policy with no third-party scripts; every mutation must come from the same site. Dependencies are pinned and audited, secrets are scanned for on every commit, and static analysis, end-to-end tests with accessibility checks on every page, and planted-defect drills — a deliberate bug that each feature’s tests must catch — run on every change. What changes is published in the [changelog](https://cablefolio.com/changelog/).

## This website

This website sets no cookies, protects its two forms with Cloudflare Turnstile and a per-network rate limit, and stores only what you send through them. Its [privacy policy](https://cablefolio.com/privacy/) says exactly what that is.

## Report a vulnerability

If you believe you have found a security problem in Cablefolio or this website, write to support@cablefolio.com with the subject “Security”, or choose **Security** on the [support page](https://cablefolio.com/support/). Include what you found, how to reproduce it, and any request id you saw. We acknowledge reports within one business day, fix confirmed problems before disclosing them, and will not take action against good-faith research. Our [security.txt](https://cablefolio.com/.well-known/security.txt) has the same details.