Credentials & sessions
Passwords are protected with scrypt and unique salts. Session identifiers and production API keys are stored as hashes rather than reusable plaintext credentials.
Security
Layered controls, clear responsibility boundaries.
Senaro Solutions applies application level controls to authentication, API access, licensing and administration. Production security also depends on secure hosting configuration, administrator practices and customer side credential handling.
Application baseline
Controls implemented in the platform.
Hashed credentialsRate limits2FA optionsAudit eventsSecurity headersTenant controls
Code-based verification
Account verification and password recovery use short-lived 6 digit email codes. Administrative accounts can require an additional email or authenticator factor.
Request protection
Sensitive browser actions require same-origin requests. Authentication, verification, contact and API workflows use server side rate limits and bounded request sizes.
Tenant access controls
Each Cosmo licence has independent status, term, quota, allowed domains, enabled capabilities and revocable credentials.
Safe API retries
Prediction requests support idempotency and quota reservation/refund handling so normal network retries do not automatically consume duplicate licensed units.
Audit & event records
Administrative, authentication and API events are recorded for operational review using privacy protective identifiers where practical.
Browser hardening
The application sets Content Security Policy, HSTS, frame denial, MIME protection, referrer controls and no-store/no-index protections for private areas.
Data separation
Business data, operational telemetry, Cosmo workloads and knowledge data use separate database connections in the production architecture.
Operational security
Controls that must remain correct after deployment.
No application can make the surrounding hosting environment or an external integration secure by itself. These operating controls remain part of the security model.
Hosting environment
Protect environment variables and database credentials, keep HTTPS enabled, maintain backups and apply supported platform updates.
Administrator access
Use a strong unique password, enable a second factor and remove access promptly when an administrator no longer requires it.
Customer integrations
Keep API keys on trusted servers, configure domain restrictions where appropriate and rotate credentials immediately after suspected exposure.
Incident response
Review relevant logs, revoke affected credentials, preserve evidence and notify affected parties when legally or contractually required.
Responsible disclosure
Found a security concern?
Please report suspected vulnerabilities or credential exposure privately. Do not include passwords, production API keys or unnecessary personal data in the initial message.
Contact securityWhat this page does not claim
Security controls reduce risk; they do not make an online service invulnerable. Configuration, dependencies, hosting, backups and incident response must remain actively maintained.