Security and privacy

Your production data is commercially sensitive. We treat it that way.

Producers are being asked to put their operating numbers into someone else's system, alongside their competitors'. That only works if the protections are structural rather than promised.

Tenant isolation

Five independent layers, none of them trusted alone

Hiding a menu item is not security. Every protected action is enforced on the server, and the test suite actively tries to break through.

01

Route

Audience-specific middleware groups separate customer, internal and administrator surfaces.
02

Context

The acting company is resolved on the server, never from a value the browser supplied.
03

Policy

Every model action is gated — including file downloads, background jobs and report generation.
04

Query

Tenant-owned records carry their company on the row, and a global scope applies it to every query.
05

Test

A dedicated security suite attempts cross-tenant reads, unauthorised downloads, identifier tampering, invitation reuse and role escalation. Those tests must fail to succeed.

Access

Nobody signs themselves up

Invite only

Devenish approves the customer company first. There is no open registration form that grants access to a tenant.

Verified domains

Invitations are checked against the company’s approved email domains. Exceptions require an administrator and are recorded.

Single-use tokens

Invitations expire, can be revoked, and are stored hashed — never in plain text.

MFA for Devenish staff

Multi-factor authentication is required for every internal nutritionist and administrator account.

Files and benchmarks

The two places data most often leaks

Files

Spreadsheets, reports and diagnostic images live in private storage, never in a web-accessible directory.
Downloads go through an authorising controller and short-lived signed links, not permanent public URLs.
Uploads are checked by extension, MIME type and file signature, with size limits and malware scanning.
Original filenames are never trusted; stored names are generated.
Spreadsheet macros are never executed, and generated exports are protected against formula injection.

Benchmarks

Consent is recorded at company level, versioned, and withdrawable.
Cohorts below ten eligible flocks are suppressed with an explanation.
The threshold is re-applied after every filter, so a cohort cannot be narrowed to one farm.
No named peer data is ever shown or exported.
Benchmark queries are logged, so repeated narrowing attempts are detectable.

An append-only record of who did what

Logins, invitations, permission changes, imports, corrections, standard publications, consent changes, report downloads and support access are all recorded. Audit rows cannot be edited or deleted from the application.

Support access is time-limited and visible

When Devenish support needs to look at your account to help with a problem, it requires a stated reason, is read-only by default, expires, shows a banner while it is active, and is fully logged. It can be revoked immediately.

Compliance

What we do not claim

Devenish Insights is built to recognised security practice, and the controls described on this page are implemented and tested. We do not currently claim SOC 2, ISO 27001 or any other formal certification for this platform, and we will not imply one before it has actually been achieved and audited.

Data retention periods, deletion and export procedures, and the consent wording for diagnostic images are being finalised with Devenish before customer pilots begin. If you need our current position in writing for a procurement review, ask us and we will give you an accurate answer rather than a marketing one.