Security & trust
Security is the product.
CapCore holds the workforce evidence that audits, tribunals and procurement teams rely on. It is engineered against ISO 27001 control objectives from the data layer up — not retrofitted.
AES-256-GCM field-level encryption
Personally identifying fields (names, work email, phone, emergency contacts, bio, TOTP secrets) are encrypted at rest using AES-256-GCM. Encryption is transparent at the data layer via a collection proxy — engineers cannot accidentally bypass it.
Key rotation, integrity health checks
The platform supports operator-driven encryption-key rotation: the new key encrypts all new writes and a re-encryption sweep rotates every existing record. An in-product Encryption Health dashboard reports the integrity of every encrypted field.
Multi-factor authentication everywhere
Every tenant user and Super Admin can enrol multiple second factors: WebAuthn / Passkeys (FaceID, TouchID, hardware keys), TOTP authenticator apps, single-use backup codes, and email one-time passcodes. Trust-this-device cookies (14-day, HTTP-only, Secure, SameSite=Lax) reduce friction on known browsers.
bcrypt password hashing
Passwords are hashed with bcrypt and a per-user salt before they ever touch the database. Plain-text passwords are never logged or retained — even in transit, they exist only inside an authenticated TLS session.
Hard tenant isolation
Every authenticated request carries a JWT with a tenant claim. The data layer enforces that claim on every read and write. A pen-test-style isolation suite runs against the platform to catch any cross-tenant leakage before release.
Role-based access control
Hierarchical roles — Platform Owner → Sub-Admin → MC Admin → Sector Admin → Manager → Member — gate every endpoint and UI surface. Session tokens are versioned so role changes invalidate all existing sessions instantly.
Append-only audit logging
Every state-changing action — appraisal sign-offs, performance-case decisions, invoice approvals, policy acceptances, role changes, security events — is written to an append-only audit log with actor, timestamp, before/after and IP.
Brute-force & abuse protection
Authentication endpoints enforce per-account and per-IP rate limits with progressive lockouts. Suspicious activity (mass-failed logins, IP-velocity anomalies) surfaces in the platform Security Alerts feed for the Platform Owner.
Subject Access Requests, built in
A SAR workflow inside the product lets the Data Controller export, restrict, anonymise or delete any subject's data — with every action audit-logged. No data engineering required, no spreadsheets exchanged over email.
Backups & recovery
Continuous database snapshots are taken automatically by the underlying cloud platform with point-in-time restore. Recovery procedures are documented and tested. Encrypted fields remain encrypted in the backup stream — the key is never co-located with the ciphertext.
No-cookie public analytics
The public marketing site uses first-party, cookieless analytics: no third-party trackers, no cross-site identifiers. We capture aggregate session counts, traffic source and approximate country (via the Cloudflare edge header) — nothing that identifies a visitor.
Responsible disclosure
Found a vulnerability? Email security@capcore.app with a description and reproduction steps. We commit to acknowledging within 24 hours and to keeping researchers informed of remediation status.
Privacy
UK-GDPR aligned, by design.
Transforming Training Teams Ltd, trading as CapCore, is the data controller for workforce-evidence data processed in the platform. Personal data is processed under contractual necessity, legitimate interest, and (where applicable) legal obligation — never sold to third parties, and shared only with vetted sub-processors needed to operate the service.
Sensitive personal data (names, contact, free-text notes, secondary-factor secrets) is encrypted at the field level. Operational and security logs are retained for 12 months; workforce evidence is retained for the duration of your subscription plus an audit buffer (typically 6 years following the end of the accounting period) unless you instruct otherwise.
You can exercise your UK-GDPR rights — access, rectification, erasure, restriction, portability and objection — by contacting mike@capcore.app. We respond within 30 days. A full Privacy Notice and Data Processing Agreement are available on request.
