Security

This page summarizes the administrative, technical, and organizational measures described in our Privacy Notice. If a practice is not listed here, do not assume we claim it.

Tenant isolation and access control

• Role-based access control with strict tenant isolation. Every server-side query is scoped to the requesting organization. Cross-tenant access is denied.
• Authorization is enforced server-side on every request. It is not derived from client-supplied claims.
• Platform staff access to a customer organization’s assessment content, tools, and contracts requires that the organization has enabled that access, or is limited to read-only support roles. All such access is recorded in an immutable audit log.

Authentication

• Passwords are stored as one-way hashes. Plaintext passwords are never written to disk.
• Multi-factor authentication is supported and is required for platform administrators. Recovery codes are stored as hashes.
• Single sign-on via OpenID Connect and SAML 2.0 is supported per organization, with protocol protections including PKCE, state and nonce validation, and XML signature verification. Our SSO assurance brief sets out each control, the test that backs it, and the limitations we state deliberately.
• Sessions are short-lived, refresh tokens are rotated, and sessions are revoked on password change, MFA reset, or sign-out. Failed-login lockout and rate limiting apply.

Encryption and secrets

• Transport Layer Security (TLS) encrypts data in transit between the browser and the Services, and between our systems and sub-processors.
• High-sensitivity secrets — MFA seeds, SSO client secrets, identity-provider certificates — are encrypted at rest with a dedicated field-level encryption key. API keys are stored as keyed hashes.
• Uploaded documents are retrieved only via short-lived signed URLs scoped to the requesting organization. Uploads are subject to size and content-type validation.

Audit and customer content

• An append-only audit log records security-relevant events: logins, MFA changes, invitations, role changes, document uploads, and administrative actions.
• We do not use assessment content, contract documents, or other customer-submitted content to train any third-party large language model. Public-market vendor research queries do not include customer assessment content.

Report a vulnerability

If you believe you have found a security issue in Pytheus, email legal@3treetech.com. Please do not file a public issue with exploit details. We will acknowledge receipt and work the report under the Terms of Service.