Current controls, evidence and assurance boundaries.
This pack is for procurement, privacy and security evaluators. It summarises controls that are implemented or directly evidenced in the RetailHawk programme and identifies assurance that is not currently claimed.
Document control
| Owner | Security / Operations |
|---|---|
| Evidence review | 11 October 2026 |
| Refresh triggers | Material identity, hosting/data-location, evidence-storage, backup/recovery, release-control or incident-process change. |
| Scope | RetailHawk application and its current operating controls. |
Control summary
| Area | Current position | Evidence status |
|---|---|---|
| Identity and MFA | Password authentication, verified-email flows, TOTP MFA and recovery codes are implemented through Laravel Fortify. Passkey/WebAuthn support is implemented through Laravel Passkeys. Security-sensitive credential changes revoke or advance session state. | Implemented and application-tested |
| Tenant isolation | Agency/client authority is derived server-side from authenticated membership and grants. Request-supplied tenant identifiers do not create authority. Negative tests cover cross-tenant access and deny-by-default behaviour. | Implemented design contract with automated negative tests |
| Evidence handling | Customer evidence is held in private object storage. New uploads are quarantined before becoming normal evidence; malware scanning is fail-closed. Public bucket listing and anonymous retrieval are not part of the design. Time-limited signed retrieval is used for authorised evidence access. | Infrastructure controls proven in operating environment |
| Backup and recovery | Database and object-store backups run on scheduled jobs, with separate restore tests and off-host backup copies. Backup freshness and restore-test status are monitored and can block release promotion. | Operating controls and restore drills evidenced |
| Release control | Staging builds are health-checked before promotion. Production promotion uses a verified staging artefact, pre-flight checks, backup gates and controlled rollback. CI cannot directly deploy arbitrary branch code. | Operating controls evidenced |
| Incident response | An incident runbook covers service disruption, suspected security incidents, evidence preservation, credential rotation, recovery and post-incident review. Personal-data breach assessment includes the applicable regulatory notification decision process. | Documented operating process |
| Monitoring | Application health, services, queue condition, backup freshness, restore tests, object-store health, malware-scanner health and certificate expiry are monitored with warning/critical thresholds. | Operating checks evidenced |
| Vulnerability and dependency review | CI checks published PHP dependency advisories and production frontend dependency audit status alongside application tests and build/type checks. This is engineering assurance, not a substitute for an independent penetration test or external certification. | Automated dependency review in CI; no independent penetration-test claim in this pack |
| Data location | RetailHawk is hosted in the UK, in the Byte Digital Cloud data centre in Newcastle. Additional residency options are not claimed unless formally available and contractually supported. | Owner-confirmed 12 October 2026; refresh on any hosting or data-location change. |
What we do not claim
No external certification claim
RetailHawk does not claim ISO 27001, SOC 2, Cyber Essentials or another third-party certification unless a current certificate is separately supplied.
No penetration-test claim
This pack is not a penetration-test report and does not state that an independent penetration test has been completed unless a current report or attestation is separately supplied.
No universal residency promise
We do not advertise additional countries or regions merely because the architecture could support them. Residency commitments must match the actual production configuration and customer contract.
No blanket compliance warranty
Technical controls support customer security and privacy reviews; they do not replace each customer's legal, regulatory or supplier-assurance assessment.
Evaluator follow-up
For a customer-specific review, we can respond to a security questionnaire and provide appropriate evidence subject to confidentiality and least-disclosure requirements. Security or procurement questions can be raised through the RetailHawk contact route for triage to Security / Operations.
Security-sensitive operational details are intentionally excluded from this public pack. Internal host addresses, credentials, secret locations, recovery commands, firewall specifics and other attack-relevant implementation details are not published.