Practical controls, described without shortcuts.
Sissel is in beta. We document controls that exist today and avoid broad certification or compliance claims that have not been independently verified.
Production security route is incomplete
Tenant separation
Application data is scoped to the active customer organisation, with database row-level security used as an additional boundary.
Credentials
Connector credentials and private keys are encrypted at rest. Secret values are not displayed again after they are saved.
Controlled delivery
Conversion sends use stable event IDs, recorded attempts and retries so failures can be inspected without creating accidental duplicates.
Origin checks
Browser events require a site-specific public key and an allowed origin. The public key alone cannot send from an unrelated domain.
Audit trail
Important configuration and delivery changes are recorded so operational decisions can be reviewed later.
Encryption boundaries
Connector credentials, normalized person identifiers, pending raw collector payloads, certificate private keys, and Zapier target URLs use authenticated AES-256-GCM encryption at rest. Identifier lookup uses keyed HMACs so database contents alone cannot be dictionary-tested. Key custody and rotation remain environment-specific and must be documented before production use.
Recovery and incident process
The repository includes encrypted backup/restore verification procedures and records consequential configuration changes. The production backup owner, recovery objectives, last restore evidence, incident owner, notification route, and subprocessor chain are environment-specific procurement evidence—not inferred from the code.