Security

Ishiro holds bank statements and invoices, so this page says plainly what protects them today and what does not exist yet. We would rather be trusted for the second list than caught out by it.

What is in place

• Nothing moves money. Ishiro has no payment rail and holds no bank credentials, so a compromise of Ishiro cannot move your funds.
• Encrypted in transit. Every request is served over HTTPS, and plain HTTP is redirected before a session cookie is ever sent.
• Passwords are hashed with a slow algorithm and never stored or logged in plain text.
• Sessions are signed and expire. Rotating our signing secret signs everyone out.
• One workspace cannot read another. Every read and write carries the workspace it belongs to, and files are served only to a session entitled to them.
• Staff access is by grant. An Ishiro staff member can only open your workspace under a grant that names the reason and expires; most grants are read-only, and writing is limited to uploading statements when you have asked us to. The grant and its use appear on your audit trail.
• The audit trail cannot be edited. Actions are appended, never rewritten, and resolved work stays on the record.
• Browser hardening. The application sends strict transport security, frame denial, no-sniff and a restrictive referrer and permissions policy.

What we have not built yet

• No formal certification. We have not done SOC 2 or ISO 27001, and we will not imply otherwise.
• No two-step sign-in yet. It is on the list, and it is the next thing we will build for a customer who needs it.
• No single sign-on, and no customer-managed encryption keys.
• No published penetration test. We will commission one before we take a customer whose policy requires it.

Reporting a problem

Write to hello@ishirohq.com with what you found and how to reproduce it. We will acknowledge within one working day, tell you what we are doing, and credit you if you want to be credited. Please do not test against another customer's workspace, and give us a reasonable chance to fix it before publishing.

If something goes wrong

If your data is exposed we will tell you what happened, what was affected and what we are doing about it, within 72 hours of knowing, and we will not wait for certainty before saying that something is wrong.