Security

Security design targets

SSO, MFA, tenant isolation, encryption and audit targets for PetroMetric. No certification is claimed.

What is in the application

Membership roles are deny-by-default. A tenant scope is applied to obligations, evidence, observations, reports and audit reads. Selected fields, including authenticator secrets, recovery codes, SSO client secrets and restricted notes, are encrypted with the application key.

Local MFA is time-based one-time passwords. SAML and OpenID Connect have start and callback hooks that check state, nonce and PKCE on the OIDC path, and that refuse an unsigned SAML response. Connecting a customer identity provider still takes that provider's metadata and a reviewed validation library in production.

What is not claimed

SOC 2, NIST and ISO 27001 language on this site is a map of design targets and of controls the code actually contains. It is not an attestation, a certificate, or a statement that an audit period has been examined. Backups, key management, residency and a restore drill are operational work for the hosting environment. WCAG 2.1 AA is the build target. A formal accessibility audit is still a production gate.

Informational only. This is not legal, tax, or regulatory advice, and it is not a certification or a government publication. A qualified legal reviewer has not been appointed. Confirm the current Act, permit, licence, and guideline before you rely on a date or a figure. PetroMetric does not file reports or applications with any agency. Source snapshot 8 November 2026, America/Guyana. Contact (592) 600-1096 or service@computingcore.net. Contact for pricing.