Security
Security
How PWAI - Intelligent Power for Data Centers protects your data. Everything on this page describes controls that are implemented in the product today.
Encryption in Transit
All traffic to the platform is encrypted with TLS.
Authentication
Bcrypt password hashing, short-lived access tokens with rotating refresh tokens, enforced email verification, Google sign-in with server-side token verification, and reCAPTCHA on sign-in and registration.
Role-Based Access Control
Granular permissions gate both the API and the interface, with system roles from super admin down to read-only auditor.
Tenant Isolation
Every organization’s data is scoped at the query layer, with dedicated automated tests for cross-tenant reads and writes.
Audit Logging
Request-level audit trails with payload sanitization, configurable retention, and CSV, JSON, and SIEM export.
Abuse Protection
Per-endpoint rate limiting, login lockout after repeated failures, IP allow/deny filters, and a configurable password policy.
Engineering Practices
- Outbound requests from integrations are validated against SSRF (server-side request forgery)
- Error responses are sanitized to avoid leaking internal details
- Security-focused automated test suite covering tenant isolation, token storage, rate limits, and injection
- Configurable data retention with automated cleanup
- Security incident tracking built into the platform
Reporting a Vulnerability
If you believe you've found a security issue, email [email protected] and we'll investigate promptly. See also our Privacy Policy.