For security officers, DPOs and compliance#

Your questions#

Question	Answer and where
What are the threats and controls?	Threat model
What is the overall status?	Status summary, findings register
What testing has been done, and what does it prove?	Test suite summary, automated suite, plan, manual checklist
How are identity and access handled?	Authentication and authorization; applications: API clients (scopes, deny by default, same 404 for "not there" and "not yours")
How are secrets protected?	Encryption, secrets and keys, credentials stay on the server
Which personal data, where, how long, which third parties?	Data protection; AI providers see only what a person sends: AI features
What is exposed to the Internet?	The public surface is read-only and published-only: architecture, section 5, draft is never public
What goes into the software?	Supply chain: SBOM, licences, provenance
What happens to our logs and audit trail?	Audit log (administrative actions, append-only) and observability and logging
Can we run it in our environment?	One workspace per organisation: design decision

Known gaps to put in your risk assessment#

Single sign-on is one OpenID Connect provider (no SAML or LDAP, no single logout; a session already open outlives a person's removal at the provider until it is deactivated), the audit log records successful actions only, retention and data subject requests do not reach backups and retention is off until you set a number, two-factor authentication and the password policy are off until an administrator turns them on, no per-website roles, no full Content-Security-Policy on the admin applications, no malware scanning, no third-party certification, throttling counted in memory per process (shared counters with the optional Valkey), a stolen client token valid until it expires. The evidence is the project's own; nobody outside the team has audited it. See the overview, chapter 4 and 8.

Reading path#

Threat model, status summary, findings, data protection, encryption, supply chain, then the design decisions.