Security Policy

2. Infrastructure Security

Machestra is built on modern, managed cloud infrastructure chosen for reliability, scalability, and security. Our providers are selected for their strong security and reliability standards.

Key protections include:

• All traffic is served through a global content delivery network with DDoS protection and a web application firewall, which also shields our origin systems.
• Application data is stored in a managed cloud database with encryption at rest, network-level access controls, and automated backups.
• Automatic HTTPS encryption is enforced across all of our infrastructure.
• Payments are handled by a PCI DSS compliant Merchant of Record. Machestra never stores payment card numbers.

Push Notifications

Push notification subscriptions (Growth plan) use the Web Push API. Subscription tokens are stored on our servers and transmitted over HTTPS. Users can revoke push subscriptions at any time from their notification settings.

Spreadsheet Import & Export

Uploaded spreadsheet data is validated server-side before processing. Row counts are capped, and all imported data is scoped to the user's company. Exports include only the data visible to the user's role.

3. Data Encryption

Machestra uses encryption to protect data both during transmission and while stored.

Encryption in Transit

All communication between users and the platform is encrypted using TLS (HTTPS), ensuring that data transmitted between browsers and the platform cannot be intercepted or read by third parties.

Encryption at Rest

Stored data is encrypted at rest at the infrastructure level, protecting it from unauthorized access.

Password Security

User passwords are never stored in plaintext. Passwords are hashed using a strong, industry-standard password hashing algorithm designed to resist brute-force attacks.

Secure Token Authentication

Machestra uses signed, short-lived session tokens for authentication. Security measures include:

• Short-lived access tokens
• Refresh tokens for session continuity
• Server-side validation of all tokens

Tokens are stored in HTTP-only secure cookies, which cannot be accessed by browser scripts. This reduces the risk of token theft through cross-site scripting (XSS).

4. Authentication and Access Control

Machestra implements multiple layers of authentication and authorization controls.

Authentication Methods

Users can authenticate using:

• Email and password
• Google OAuth 2.0 (optional)

Google authentication is used only when users explicitly choose the Google sign-in option.

Account Security Tokens

Security-sensitive operations such as email verification, password reset, and user invitations use time-limited tokens that expire quickly to reduce the risk of misuse.

Role-Based Access Control (RBAC)

Each user is assigned a role within their company workspace:

• Admin: Manage users, configure machines and resources, control account access
• Manager: Create and manage production schedules, manage operational data
• Operator: View assigned jobs and tasks

Permissions are scoped based on these roles to prevent unauthorized access to sensitive functionality.

6. Rate Limiting and Abuse Prevention

To protect the platform from abuse and automated attacks, Machestra applies rate limiting across the API, with stricter limits on authentication endpoints to prevent brute-force and credential-stuffing attacks. Automated abuse is detected and throttled.

7. Application Security

Secure coding practices are applied across the platform.

Input Validation

All API inputs are validated server-side against strict schemas, ensuring that only properly structured data can be processed by the system.

Injection Prevention

Database queries use parameterized methods and validated inputs to protect against injection attacks.

Cross-Origin Request Controls

Cross-Origin Resource Sharing (CORS) restrictions are implemented to ensure that only authorized origins can access the API.

Secure Cookie Practices

Authentication cookies are:

• HTTP-only
• Secure
• First-party

These settings prevent JavaScript access and reduce exposure to XSS attacks.

8. Data Backup and Recovery

Machestra runs automated, encrypted backups on a regular schedule. Each backup is validated for integrity and monitored with automated alerts on failure, and multiple retention tiers are kept with older backups pruned automatically.

Our managed database provider also performs automated cloud backups with point-in-time recovery. Together, these mechanisms protect against accidental data loss, corruption, and infrastructure failures.

9. Monitoring and Audit Logging

The platform maintains activity logs that record important user actions. Examples include:

• Job creation or modification
• Machine updates
• Inventory changes
• Scheduling adjustments

These logs create an audit trail that helps organizations track operational activity within the platform. Automated system processes also run scheduled maintenance and operational monitoring, and real-time notifications help users stay aware of critical events.

10. Incident Response

If Machestra becomes aware of a security breach affecting customer data, we will investigate promptly and notify affected customers without undue delay once the incident is confirmed and relevant details are available.

Our incident response process includes:

• Immediate investigation and containment of the affected systems
• Assessment of the scope and impact of the breach
• Notification to affected customers via email with details of what occurred, what data was involved, and what steps are being taken
• Notification to relevant regulatory authorities where required by law (e.g., within 72 hours under GDPR)
• Post-incident review and implementation of measures to prevent recurrence

Security incidents can be reported to: [email protected]

11. Account Security Features

Machestra provides administrators with tools to manage user access within their organization. Administrators can:

• Force logout of any user in their company workspace
• Activate or deactivate user accounts
• Invite new users with time-limited invitation tokens

Users can also:

• Update their passwords
• Manage notification preferences

These controls allow companies to maintain strong internal account security practices.

12. Internal Access Controls

Access to Machestra's production systems, databases, and infrastructure is strictly limited to authorized personnel on a need-to-know basis.

• Production database access is restricted to essential operations personnel only.
• Access credentials are never shared and are rotated regularly.
• Customer data is accessed only when necessary to provide the service, resolve a support request, or investigate a security incident.
• Machestra employees and contractors do not access customer operational data for any purpose unrelated to service delivery.

13. Responsible Disclosure

We welcome responsible disclosure of security vulnerabilities.

If you believe you have discovered a security issue affecting Machestra, please report it to us so we can investigate and address it.

Please include:

• A detailed description of the issue
• Steps to reproduce the vulnerability
• Any relevant screenshots or logs

Security reports can be sent to: [email protected]

We appreciate the work of security researchers who help improve the safety of our platform.

14. Questions

Questions? Contact us at [email protected]