Using ScaleEnabler
Your Data and Information Security
ScaleEnabler uses layered security to protect the public website, authenticated client and partner portals, and the information associated with that work.
Public Website Architecture
The public ScaleEnabler website uses a static web architecture hosted on secure cloud infrastructure. Pages are prepared in advance, reducing the amount of software exposed to visitors and giving the site a relatively small public attack surface compared with conventional dynamically administered websites.
The public site does not rely on a traditional publicly exposed content-management application or public administrative interface. Encrypted HTTPS connections protect traffic between your browser and the website. Network and perimeter protection includes mitigation of distributed denial-of-service (DDoS) attacks intended to overwhelm a site with traffic.
Browser and Application Protection
Security headers tell browsers how to handle our pages and content. These protections help reduce risks from deceptive embedding of pages to trick users into clicking (clickjacking), inappropriate content or script execution, and files being interpreted as the wrong content type.
Browser permissions are also restricted to reduce unnecessary access to device capabilities.
Authenticated Client and Partner Access
Private client and partner areas require authenticated access. Several layers work together to establish who a user is and what they are authorised to do.
- Web Security & Infrastructure Protection
- Protects the website and application perimeter, including the services that deliver the public site and private portals.
- Identity & Authentication
- Verifies the identity of users requesting access to secured areas through the login and authentication process.
- Role-Based Access Control
- Determines what authenticated users are authorised to access and do, according to their assigned role.
- Application-Level Data Isolation
- Enforces boundaries between organisations, clients, roles and information within the ScaleEnabler application.
Client and Organisation Isolation
Authenticated access alone is not enough. The system also determines which organisation a user belongs to, which areas they are authorised to access, what information they can see and what actions they can perform.
ScaleEnabler applies access controls and data separation at the application level so users receive access appropriate to their organisation and role. Signing in does not provide general access to other clients' or partners' information.
Security Principles
- Individual identities: individual user accounts rather than shared accounts where practical.
- Additional protection for privileged access: multi-factor authentication for privileged ScaleEnabler access.
- Least privilege: access limited to what each person needs for their work.
- Client separation: strict separation of client information through application access controls and data boundaries.
- Protected secrets: passwords, private keys and other service secrets are kept out of front-end code delivered to browsers.
- Browser protections: security headers help browsers handle content safely.
- Protection against misuse: rate limiting and appropriate web application and API protections help control excessive or abusive requests.
- Audit logging: records of relevant access and activity support review and investigation.
- Separate environments: development, preview and production environments are kept separate.
- Regular access review: permissions are reviewed to keep access appropriate as work and responsibilities change.
Layered Security
We deliberately use multiple layers of security. Web security and infrastructure protection safeguards the perimeter. Identity and authentication controls verify who is requesting access. Role-based access control determines what they are authorised to access and do. Application-level data isolation enforces the organisation, client and information boundaries.
These controls work together rather than relying on a single layer of protection. We treat security as an ongoing operating responsibility, with controls and access reviewed as part of running the service.