Security
What is enforced and tested, and what is not.
This page describes release 0.1.4 of the standalone (container) edition, from the code and its automated tests. It says "enforced and tested", never "secure" or "compliant". There has been no independent security test.
Where your data lives
- Attesta runs in your environment: a container with a SQLite file on your host. Attesta, the company, runs no service that holds your data and keeps no copy.
- The server makes no outbound calls in the pilot configuration. Users' browsers load the SAP UI5 libraries from
ui5.sap.com; that is the only external address the screens use. - Attesta never posts to SAP. It writes an export file that your people take to SAP, and the evidence pack is a printable file your team attaches.
Built and tested
Sign-in and users
- Named users only. Passwords are set by an administrator at a hidden prompt (12 characters or more) and stored only as salted scrypt hashes.
- Pilot mode refuses to start with demo users, a default or short password, or no users file.
- Sign-in backoff, then lockout after five failures for that user and address (15 minutes). The auth log is tested to hold no password or hash.
- Every data and service call answers 401 without credentials.
Roles and segregation of duties
- Four roles: asset accountant, project accountant, approver, auditor. The auditor is read-only. A matrix test runs every role against every action.
- The approver is never the proposer, by user id, on every approval path, including a user who holds both roles. A parallel double approval gives one success and one conflict.
- Lines lock at approval. Actor, state and money fields cannot be written except by the actions. Stale or simultaneous actions get 409.
Integrity and evidence
- Value from the cost source: the lines of a proposal add up to the asset under construction to the cent, with amount source and basis shown on every line.
- The export is built once, stored with its SHA-256 and replayed byte for byte. Text cells that could run as spreadsheet formulas are neutralised.
- An audit entry for every create, update and delete, and one per row for each capitalisation action. In pilot mode business data is soft-deleted.
- The decision journey records zero connector writes to SAP; a test guards it.
Browser and transport
- Security headers, a content security policy, frame denial, a same-origin check on every write and a request size limit.
- TLS is your reverse proxy's job. The deployment kit documents it.
Operations
- Backup and restore tool with checksum and integrity check; additive, backed-up schema migration on start;
/healthand/version.json. - Usage statistics are opt-in per user, off by default and pseudonymous, with no amounts, asset ids, names or free text. Default retention is 180 days.
Known gaps
| Gap | What it means for you |
|---|---|
| No single sign-on in the standalone edition | Passwords are managed by an administrator. No sign-out button, self-service password change or multi-factor sign-in (HTTP Basic). |
| No encryption at rest by Attesta | The database and backups are plain files. Use host or volume encryption. |
| BTP edition not deployed or tested | Descriptors and code exist. Role collections, destination and HANA Cloud behaviour have not been run. |
| Container and proxy kit not run | The image build, compose file and proxy snippets have not been run; the same commands were run natively on Node 20. |
| Export file never loaded into a real SAP system | A first run needs your SAP team's review. The read-back from SAP is typed in by the approver. |
| Rate limits are per process and in memory | A restart clears a lockout. A rate limit at your proxy adds protection. |
| User administration is not in the audit trail | Keep host-level change records. |
| Screen code is served without sign-in | The screens' code, /health and /version.json answer without credentials. No data does. |
| Every role reads all data of the instance | No separation by company code or project. One instance serves one client. No external-party users. |
| No high availability | One instance, SQLite on local disk. A host failure means a restore from backup. |
Not claimed
No penetration test, no load test, no accessibility audit, no certification of any kind, no SAP certification, no SAP Store listing. Security review of the final build is a release step, and its result is not stated here.
Source documents: the pilot kit's data-handling sheet and known-limitations list (release 0.1.4). Ask us for them. To report a security concern, use the contact address on the home page once it is confirmed.