Security overview

Hosting and separation

1. The platform runs on Microsoft Azure in the UK South (London) region, in managed services that the provider secures physically and certifies to ISO 27001 and SOC 2.
2. Each customer organisation is a separate tenant. Every request is checked against the signed-in user’s organisation, and data from one tenant is never returned to another.
3. Each product runs as its own service. MAR² Ledger keeps its records in its own database server, with database-level separation between customer organisations.

Encryption

1. Data in transit is encrypted with TLS 1.2 or later. Data at rest is encrypted by the hosting provider with AES-256. Secrets and keys are held in a managed key vault, not in code.
2. Sensitive values such as third-party access tokens and multi-factor secrets are additionally encrypted by the application before they are stored.

Identity and access

1. Users sign in with MAR² ID, which supports multi-factor authentication with an authenticator app. It is required for platform administrators and for MAR² Ledger. Customer administrators control roles and permissions in each product.
2. MAR Squared staff access production only when needed, through named accounts, on the principle of least privilege.

Logging and audit

1. Security-relevant actions, such as sign-ins, changes to who has access, exports and deletions, are written to an audit trail that customers can review.

Secure development

1. Changes are made through pull requests, tested automatically, and released through a controlled pipeline that needs an approval before anything reaches production. Dependencies and container images are checked for known vulnerabilities, and new code is checked for leaked secrets.
2. The website sends a content security policy and loads no third-party scripts.

Backups and continuity

1. Databases are backed up automatically with point-in-time recovery, and backups are kept in the UK.

Incident response

1. We follow a documented personal data breach procedure. We notify affected customers of a personal data breach without undue delay and within 48 hours of becoming aware, as set out in the data processing addendum.

Vulnerability disclosure

In shortFound a security issue? Email us. We will not take legal action against good-faith research that follows these rules.

1. Report suspected vulnerabilities to security@marsquared.com. Include enough detail for us to reproduce the issue. Our contact details are also published in security.txt.
2. We will acknowledge your report within 3 working days, keep you informed, and credit you if you wish once the issue is fixed.
3. Please: test only against your own accounts; do not access, change or delete other people’s data; do not degrade the service; and give us reasonable time to fix the issue before disclosing it.
4. If you follow these rules in good faith, we will treat your research as authorised and will not pursue legal action against you.