// SecurityPage.jsx // // Grounds the Home page's "Enterprise-Grade Security" stat tile in the // platform's real guardrails (trans-backend's actual auth/tenancy code, // per CLAUDE.md / SPEC-07 Section 0/8) - JWT auth, RolesGuard, per-company // Role templates, companyId-scoped tenant isolation, immutable business- // rule snapshots - plus the real infrastructure (AWS S3, dedicated VPS). // Deliberately claims no third-party certification (SOC 2, ISO 27001, // etc.) since none exists; says so directly rather than staying silent // and letting a visitor assume one. // // Loaded as a classic (non-module) Babel-transformed script - see // index.html's header comment. React 19 ships no UMD global, so // `window.React` here is the bridge index.html's ESM import sets up; hooks // are called as `React.useState` etc. (fully qualified) for the same // shared-global-scope reason documented in Navbar.jsx. const SECURITY_PILLARS = [ { title: "Authentication & Access Control", points: [ "JWT-based authentication on every request - no session state a server has to trust blindly.", "Role-gated routes (Admin, Owner, Customer, Staff) enforced server-side, not just hidden in the UI.", "Per-company Role templates control View, Contribute, or Manage access at the module level - sales, purchase, inventory, and more are gated independently.", "Public routes (like the no-login Customer Portal) are explicitly marked as public - every other route requires a valid token by default, not the other way around.", ], }, { title: "Multi-Tenant Data Isolation", points: [ "Every tenant-owned record is scoped to its company - one customer's data is never queryable from another's session.", "That scoping is read from the authenticated request itself, not a value the client can send or override.", "Admin impersonation (used for support) is explicit, header-based, and never bypasses the underlying company scoping - an impersonating Admin sees exactly what that company's data looks like, nothing more.", ], }, { title: "Data Integrity", points: [ "Business rule calculations are snapshotted immutably at the moment they're applied, so a later rule edit can't silently rewrite historical numbers.", "Every commercial record (orders, shipments, GRNs) carries a full status lifecycle instead of a single mutable flag.", "Customer delivery confirmations lock once a shipment reaches a final state - not editable after the fact by either side.", ], }, { title: "Infrastructure", points: [ "Files and documents are stored on Amazon S3.", "The platform runs on a dedicated, secured VPS - not shared free-tier hosting.", "Database credentials and API keys are never exposed to the browser.", ], }, ]; const DATA_OWNERSHIP_POINTS = [ "You retain all rights to the operational data you enter - SkelBiz retains rights to the platform itself, not what you put into it. See our Terms of Service.", "Admin impersonation exists for support, is explicit and header-based, and never grants access beyond what that company's own data looks like.", "If you stop using SkelBiz, you can request your data - reach out through Contact and we'll respond directly, not through a ticket queue.", ]; const SECURITY_FAQS = [ { q: "Can another company on the platform ever see our data?", a: "No - every tenant-owned record is scoped to its own company at the data layer, not just filtered in what the interface displays.", }, { q: "Who can impersonate our account, and why would they?", a: "Only an Admin role, for support purposes, using an explicit header - not a silent background permission. It never bypasses the same company-scoping every other request goes through.", }, { q: "Do you have a bug bounty or formal disclosure program?", a: "Not a formal program yet - we're early. If you find something, tell us directly through Contact and we'll respond ourselves, not through an automated queue.", }, { q: "Is pricing or commission data visible to unauthorized roles?", a: "No - Business Rules and pricing data are gated by the same per-module Role permissions as everything else, enforced server-side.", }, ]; function SecurityPage() { useDocumentMeta( "Security & Trust - SkelBiz Manufacturing Operations Platform", "How SkelBiz protects your manufacturing data: JWT authentication, per-company role-based access control, strict multi-tenant isolation, immutable audit trails, and infrastructure on Amazon S3 and dedicated VPS hosting." ); return ( <>
Security & Trust

Your production data, treated like it matters.

Here's exactly how access control, tenant isolation, and infrastructure work - not a marketing checklist.

{SECURITY_PILLARS.map((pillar) => (

{pillar.title}

    {pillar.points.map((point) => (
  • {point}
    • ))}
))}

What we're not claiming

We're a growing platform, not an enterprise incumbent - we don't hold a SOC 2, ISO 27001, or similar third-party certification today, and we'd rather tell you that directly than let a badge imply otherwise. Formal certification is on our roadmap as our customer base scales.

How your data stays yours

Security FAQ

{SECURITY_FAQS.map((item) => (

{item.q}

{item.a}

))}

Have a question we didn't cover?

Ask us directly - on a demo call, or through Contact. We'd rather answer it live than leave it unclear.

Request a Demo
); }