EightMap Logo
Trust Center • Security

Security & Data Protection

A high-level technical overview of EightMap's data protection, access controls, and infrastructure defenses.

Core Security Architecture

Defendable, code-level controls active across all production customer environments.

Contact: [email protected]

1. Multi-Tenant Data Isolation

PostgreSQL Kernel RLS
  • Multi-tenancy is enforced directly inside the database engine via PostgreSQL Row-Level Security (RLS) on all operational tables.
  • Application-layer queries and database-level isolation operate concurrently; cross-tenant data access is mathematically rejected at the engine level.

2. Data Encryption (At Rest & In Transit)

AES-256 • TLS 1.3
  • All customer database storage and automated backups are encrypted at rest using industry-standard AES-256 encryption.
  • All external network traffic enforces TLS 1.3 in transit with HTTP Strict Transport Security (HSTS Preload) to prevent eavesdropping and interception.

3. Single Active Session Concurrency

1 Session / User
  • User sessions are cryptographically validated in real-time against active database state on every request.
  • Logging in from a new device immediately supersedes and terminates prior active sessions, eliminating shared credential usage across teams.

4. Role-Based Access Control (RBAC) & Scope Verification

Least Privilege
  • Granular permission boundaries distinguish between Organization Admins, Editors, and read-only Viewers. Unprivileged mutations are rejected prior to execution.
  • Every mutation and query validates organization tenancy and parent plant ownership before processing, eliminating Insecure Direct Object Reference (IDOR) risks.

5. Edge Perimeter & DDoS Protection

Cloudflare Edge • WAF
  • All web traffic routes through Cloudflare's global edge network with automated DDoS mitigation and intelligent edge rate limiting.
  • Public inquiry endpoints are shielded against automated scrapers and bot floods using Cloudflare Turnstile challenges.

6. Hardened HTTP Security Headers

Zero Clickjacking • Strict CSP
  • X-Frame-Options: DENY permanently prevents UI clickjacking and iframe embedding across unauthorized domains.
  • X-Content-Type-Options: nosniff, strict Referrer Policies, and Content Security Policies (CSP) prevent cross-site scripting (XSS) and MIME sniffing.

7. Input Validation & Parameterized Queries

Type-Safe • Zero SQL Injection
  • 100% of API endpoints and server actions parse inputs through strict runtime schema validation (Zod). Unexpected parameters are dropped before execution.
  • All database queries compile into parameterized statements via modern ORM compilers. Dynamic raw SQL concatenation is prohibited, eliminating SQL injection vectors.

8. Customer Data Ownership & Privacy

Zero Telemetry Sharing
  • Customers retain exclusive ownership of all uploaded manufacturing landscape architectures, IT/OT registries, and maturity scores.
  • Customer data is never sold, leased, or used to train public AI foundation models.

9. Vulnerability Reporting & Security Inquiries

Direct Inquiries
  • For enterprise security questions, vendor risk assessments, or coordinated vulnerability reporting, contact our team directly at [email protected].
  • Submissions are acknowledged within 48 business hours with direct technical coordination.
EightMap • Enterprise Manufacturing Landscape Platform • Inquiries: [email protected]