Security & Data-Handling
How Polaris IT & Security Consulting protects your documents · Effective January 1, 2026 · Version 2026-08-03
Encryption
Every uploaded file is encrypted at rest with a unique per-file key (AES-256-GCM), and that key is itself wrapped by a master key that is never stored alongside the data (envelope encryption). Data is encrypted in transit with TLS. Because stored files are encrypted, they benefit from the encryption safe harbor recognized under Indiana's breach-notification law.
Authentication
Accounts are invitation-only with one-time, expiring, single-use setup links; passwords are stored only as salted hashes. Multi-factor authentication (authenticator-based) is supported, and password resets revoke existing sessions. We do not send login "magic links" by email, which reduces exposure to phishing.
Access control and isolation
Access is least-privilege and scoped to a single organization: staff see only clients assigned to them, organization administrators see only their own organization, and the platform operator cannot read customer documents. Every access is authorization-checked against the authenticated user — a client-supplied identifier never grants access.
Monitoring and retention
Security-relevant actions are recorded in an audit log that excludes secrets such as passwords, tokens, and keys. Documents auto-expire after their organization's retention window (14 days by default) to minimize the data at risk.
Reporting a vulnerability
If you believe you have found a security issue, contact jgonzalez@polarisnitcs.com. Please do not publicly disclose it until we have had a reasonable opportunity to respond.