ODPS™ | Security & Governance (I)

CURRENT SECURITY STATUS

Encryption in TransitTLS 1.3 — LIVE

Encryption at RestAES-256 — SUPABASE MANAGED

Row Level Security (RLS)ENABLED — 4 POLICIES ACTIVE

API Key ManagementPUBLISHABLE KEY — CLIENT SIDE

Secret Key ManagementSERVER-SIDE MIGRATION PLANNED

Platform Password HashingSHA-256 — WEB CRYPTO API

GitHub RepositoryPRIVATE — ODPS-SYSTEMS/ODPS-V2-PRO

GitHub 2FAENABLED — GITHUB MOBILE

Netlify DeploymentPROD — on-demandprototypesystems.com

SOC 2 CompliancePLANNED — POST-SERIES A

Penetration TestingPLANNED — POST-FUNDING

ACCESS CONTROL

5-password vertical access system (Admin + 4 verticals)
SHA-256 hashed credentials — no plaintext stored in code
Session-based authentication (sessionStorage)
Admin-only Financials, Vendor KPI, Metrics dashboards
Vertical mismatch detection blocks wrong CAD uploads
Server-side credential validation not yet implemented
OAuth / SSO planned post-Series A

DATABASE SECURITY (SUPABASE)

RLS enabled on compliance_logs table
platform_insert_only policy — writes via Netlify function only
no_public_read — anon key cannot read without explicit policy
no_public_delete — delete blocked for all anon/public roles
platform_read_all — anon read enabled for dashboard queries
Supabase publishable key rotated July 2026
Secret key still client-accessible in Netlify function env

PLATFORM SECURITY

HTTPS enforced via Netlify CDN (60+ global edge locations)
autocomplete="off" on all credential input fields
No password stored in localStorage or sessionStorage
George Jin removed from Supabase Auth (July 2026)
Montreal + Storai accounts on company emails
CSP headers not yet configured
HSTS preload planned post-funding

AUDIT & COMPLIANCE

Every transaction logged to compliance_logs (Supabase)
Immutable chain-of-custody hash per node transition (Claim 18)
246+ transactions logged — $177M+ processed
Authorization Certificate generated per transaction
ITAR / AS9100 / FDA / IPC-A-610 / ASTM F963 routing live
ITAR export control review not formally completed
Formal ITAR compliance review planned pre-enterprise clients

CREDENTIAL ROTATION POLICY

Platform passwords: rotate monthly (next: August 2026)
Supabase API key: rotate on any team change
GitHub: 2FA active, rotate tokens quarterly
Netlify: rotate on team change
Automated rotation tooling planned post-DevOps hire

INCIDENT RESPONSE

Unauthorized access: rotate all credentials immediately
Data breach: notify affected parties within 72 hours
Primary contact: ellegrey@ellegreyllc.com
Legal liaison: legal@ellegreyllc.com (Montreal C. Gray)
Formal incident response plan: post-Series A
Cyber insurance: evaluate post-first revenue

CREDENTIAL REGISTRY (ADMIN ONLY)

SYSTEM	TYPE	LAST ROTATED	NEXT ROTATION	OWNER
Platform Gate Password	SHA-256 Hash	July 7, 2026	August 7, 2026	CEO
Aerospace Credential	SHA-256 Hash	July 7, 2026	August 7, 2026	CEO
Medical Credential	SHA-256 Hash	July 7, 2026	August 7, 2026	CEO
IoT Credential	SHA-256 Hash	July 7, 2026	August 7, 2026	CEO
Consumer Credential	SHA-256 Hash	July 7, 2026	August 7, 2026	CEO
Supabase Publishable Key	API Key	July 2026	On team change	CEO
GitHub 2FA	TOTP	July 20, 2026	Continuous	CEO
Netlify Account	Password + 2FA	2026	Quarterly	CEO

← COMMAND CENTER | ORG CHART | LLM WORKFLOW | METRICS | R01 REVENUE | R02 VENDORS | R03 TRANSACTIONS | R04 COMPLIANCE