Security

What this page is

This page describes the security practices Castis operates. It does not claim any certification we do not hold. Where an audit, attestation or certification is obtained, it will be named here with its scope and date, and the report made available under a non-disclosure agreement.

Identity and access

Access to the platform is authenticated through an OpenID Connect identity provider. Multi-factor authentication is required for administrative and privileged access, and can be required for any role by an organisation's policy.

Authorisation is evaluated server-side against identity, relationship, scope and action. Navigation visibility in a console is never the control; the server decides every consequential action.

Internal access to production follows least privilege, is granted for a business reason, is logged, and is reviewed periodically and on role change or departure.

Tenant isolation

Customer data is separated by tenant and enforced at the database layer, not only in application code. Every query executes within the tenant scope of the authenticated principal.

Encryption and key management

Data is encrypted in transit using current TLS versions and cipher suites, and at rest using platform-managed encryption. Content protection keys are exchanged with packagers and licence servers using standard key exchange, and are held in a restricted key management service with access logged.

Content protection

Multi-DRM, token authentication and anti-piracy controls are available for premium video delivery. Configuration is per customer and per distribution profile.

Logging and monitoring

Consequential actions are logged with the actor, the time, the tenant and the object acted on. Platform, pipeline and device health are monitored continuously, with alert routing and escalation.

Logs are protected against tampering and retained for the periods stated in the Privacy policy.

Secure development

Changes pass code review, automated testing and dependency scanning before release. Releases are versioned and signed, and can be rolled forward to a previous known-good state. Architectural rules governing which component may write which data are enforced in the build, not left to convention.

Vulnerability and patch management

Dependencies and infrastructure are monitored for known vulnerabilities. Remediation is prioritised by severity and exposure. Critical issues affecting production are addressed on an expedited schedule.

Responsible disclosure is welcomed — see the Acceptable use policy.

Incident response

We maintain an incident response procedure covering detection, triage, containment, eradication, recovery and post-incident review. Customers affected by a security incident involving their data are notified without undue delay and, where personal data is involved, within the periods set out in the Data processing addendum.

Resilience and continuity

Production data is backed up, backups are tested, and recovery objectives are defined per deployment profile. Delivery components are designed for failover, including origin shielding and multi-path routing.

Supplier security

Sub-processors and suppliers with access to customer data are assessed before engagement and periodically thereafter. The current list is on the Subprocessors page.

Deployment profiles

The platform can be deployed as multi-tenant cloud, managed dedicated, customer-operated on-premise, hybrid or edge. Placement and operating responsibility differ by profile; policy, audit and isolation semantics do not.

Security questions and questionnaires: partner@castis.io.