Security Policy

1. Our Approach to Security

PathWrite (operated by ATH Solutions) treats the security of your account and personal information as a core responsibility, not an afterthought. This page summarises the technical and organisational measures we use to protect the platform.

2. How We Protect Your Data

• Passwords are hashed (never stored in plain text) using an industry-standard algorithm with a per-account salt and a server-side pepper.
• Every tenant's data is isolated at the database level using PostgreSQL Row-Level Security, in addition to application-level access checks.
• Sessions use short-lived signed tokens with refresh rotation, and can be revoked instantly by an administrator if a device is lost or a credential is suspected compromised.
• Optional two-factor authentication (authenticator app) is available for account sign-in, and is mandatory for administrator accounts.

3. Reporting a Vulnerability

If you believe you have found a security vulnerability in PathWrite, please report it to us privately rather than disclosing it publicly. We ask that you do not access, modify, or delete data that does not belong to you while investigating an issue.

Contact: security@ath.solutions

4. Incident Response

Should a security incident affect your personal information, we will notify affected users and the relevant regulator in line with our POPIA/GDPR obligations. Compromised credentials can be contained immediately via session revocation, and every account action is recorded in a tamper-resistant audit trail.