Security your procurement team can review.

Security is a delivery requirement

Co‑Venant operates a client platform alongside marketing delivery. Access control, auditability, and data handling are designed in — not bolted on after launch.

Authentication & access

• Auth.js sessions with role-based access for admin, staff, and client portal users
• Middleware gates for /admin and /client routes — UI checks are never sufficient alone
• Passwords hashed with bcrypt; secrets stored in environment configuration only
• Login events recorded for security review

Data handling

• Lead and client data stored in PostgreSQL with application-layer tenant scoping
• Document and file metadata tracked with permission-aware access paths
• Email delivery logged via SMTP with template and status history
• Audit log for sensitive administrative actions

Operational practices

• HTTPS-only production deployment expected
• Backups and restore procedures for database and object storage
• Rate limiting on authentication and public API routes (in-memory; no external Redis required)
• MIME validation on uploads; virus scanning integration on roadmap

Privacy & cookies

We collect only what we need to respond to enquiries, deliver services, and improve the site. See our Privacy Policy and Cookie Policy for categories, retention, and your rights under UK GDPR.

Questions or concerns

For security or privacy enquiries contact hello@co-venant.co.uk. We respond to good-faith reports promptly and will coordinate with client stakeholders where programmes are active.