Security at MAUZOP
Security information should be useful enough to evaluate, and limited enough to remain true.
1. Account access
MAUZOP includes password authentication, Passkey sign-in and MFA management interfaces. Authentication, session and role enforcement remain part of the existing application security architecture; this public page does not redefine those controls.
2. Tenant and role boundaries
The repository includes row-level-security migrations, scoped server access patterns and tenant-isolation verification scripts. These are engineering controls, not a certification. Their production effectiveness depends on the approved migrations and production configuration being applied and verified.
3. Evidence uploads and file access
Standard evidence uploads use controlled file handling and a malware-scan state. When the configured scanner is unavailable, the upload path is designed to remain on manual hold rather than silently treating the file as clean. Access to ordinary uploaded evidence is restricted while malware scanning or authorised handling is incomplete.
An optional client-side encrypted evidence path is handled differently: the server cannot inspect or malware-scan plaintext it cannot decrypt. That limitation is shown in the product rather than being presented as equivalent to a scanned upload.
4. Browser caching
The service worker treats authenticated/private pages, API routes and HTML documents as network-only. Public static assets are cached only when the response does not declare private or no-store caching and does not set a cookie.
5. Data minimisation and privacy
The publication-approved Privacy Policy explains what information MAUZOP may process, why it may be processed and what users should not upload unless a specific workflow requires it. Security statements on this page do not replace that policy.
6. Security concerns
If you believe you have found a security or privacy issue, use the published contact path so the concern can be reviewed without exposing credentials, secrets or sensitive customer data in a public channel.
7. What we do not claim here
- No claim of SOC 2, ISO 27001, PCI, HIPAA or equivalent certification is made on this page.
- No claim of zero security risk, perfect prevention or guaranteed recovery is made.
- No deployment-specific control is described as verified unless the corresponding production evidence has actually been established.