Security
Security at MASK.
Enterprise-grade security built into every layer of the platform, not bolted on as an afterthought.
Security practices
Layered defenses for
every threat vector.
Encryption in Transit
All data transmitted over TLS 1.2+. HTTPS enforced on all endpoints including redirect traffic.
Credential Security
Passwords hashed with bcrypt. API keys stored using irreversible SHA-256 hashing. httpOnly secure cookies.
Role-Based Access Control
Nine roles enforced server-side: Owner, Admin, Manager, Editor, Analyst, Billing, Developer, Client Viewer, and Client Approver. Custom roles can narrow a member further.
Audit Logging
Significant actions recorded in an audit history with configurable retention controls. Authentication, permission changes, and admin operations.
Abuse Prevention
Every destination is checked against MASK's own blocklist and Google Web Risk, and risky links are held for review. Rate limiting per account and IP. Public abuse reporting, with review and appeals.
Data Isolation
Multi-tenant architecture: every read and write is scoped to the workspace that owns the data and checked against the member's role on each request.
Compliance
Compliance and data protection.
GDPR Aligned
Data minimisation, retention controls, export/deletion capabilities, and cross-border transfer transparency.
Single Sign-On
SAML single sign-on is built and configurable on Enterprise, but is not switched on yet: sign-in through an identity provider does not work today.
Privacy by Design
Visitor IP addresses are one-way hashed before analytics storage, conversions carry no personal data about visitors, and each feature collects only what it needs.
Incident Response
Structured incident response procedures with breach notification commitments and forensic logging.
Security meets speed.
Need to review our security posture for procurement? We provide security questionnaire responses and can schedule a review call.
Contact Security Team