BordersHub Trust Center

Self-attested

How LamWorks protects BordersHub and the information organizations entrust to it. Everything on this page describes controls that are in place today; work that is planned is labelled as planned.

Security questionnaire (CSV) View questionnaire
BordersHub has not yet been independently audited. We do not hold SOC 2 or ISO/IEC 27001 certification. The infrastructure providers we rely on hold their own certifications, listed below. Our security policies are available to customers on request.
Data hosting
Canada
Encryption
TLS (HTTPS) in transit
Multi-factor authentication
Required for all admins
Audit trail
Append-only, visible to each customer
Backups
Daily, kept for 30 days
Vulnerability scanning
On every code change and weekly

Security controls

Identity and access

  • Multi-factor authentication (TOTP) is mandatory for every organization administrator
  • Organizations can require MFA for all their members
  • Configurable password length, complexity and account lockout per organization
  • Passwords stored as salted, iterated PBKDF2 hashes
  • Role-based access with ten roles (Admin, Contributor, Approver, Governance, InfoSec, Risk, Auditor, Sales, Read-only and Billing user), each limited to the sections it needs, with view-only access where it only needs to look
  • Roles also decide who may open partners’ full profiles and download their evidence
  • Trust profiles are published only after internal sign-off, recording who approved, in what capacity and when
  • Removed members lose access, and only an organization admin can restore them; evidence downloads re-check the account on every request
  • Sign-ups at an organization’s company email domain stay inactive until one of its admins approves them

Data protection

  • Each organization’s data is isolated and private by default
  • Full profiles and evidence are shared only with organizations the customer approves, revocable at any time
  • Evidence files live in private storage, never behind public links, and are sent with no-cache headers
  • All traffic over HTTPS with HTTP Strict Transport Security
  • Each published trust profile is kept as a tamper-evident record: a SHA-256 fingerprint and an ECDSA P-256 signature made with the organization’s own key, checkable by anyone at /verify
  • Record signing keys are kept outside the database, so a database change can’t produce a valid signature
  • Deleting an organization removes its data immediately; backup copies expire within 30 days

Logging and resilience

  • Sign-ins, changes, approvals, evidence views and downloads, trust decisions and API token use are logged with actor, time, IP and browser
  • Audit logs are append-only, enforced by the application and by the database
  • Customers can search their audit log and export it through the API
  • Automated daily database and file backups, retained for 30 days, with a documented restore procedure

Secure development

  • Every change goes through version control with automated build and tests
  • Open-source scanning on every change and weekly: Trivy (dependencies, secrets, configuration, container image), Semgrep (static analysis) and the NuGet vulnerability audit
  • Dependabot keeps packages, base images and CI actions up to date
  • Defined patch timelines: critical 7 days, high 30 days, medium 90 days
  • API tokens: shown once, stored hashed, one-year maximum lifetime, rate limited to 120 requests per minute

Architecture

Users’ browsers
and API clients
HTTPS
BordersHub application
ASP.NET Core, non-root container; authentication, authorization and audit logging
PostgreSQL
organizations, profiles, audit logs
Private file storage
evidence and attachments
Daily backups
30-day retention

Files are never served directly from storage: every download passes through the application, which checks permission at that moment. Data is hosted in Canada.

Infrastructure and sub-processors

Providers that host, store or deliver parts of the Service. Their certifications are their own, not LamWorks’s.

ProviderPurposeLocationProvider certifications
Paddle (Paddle.com Market Limited and its affiliates) Reseller and merchant of record for BordersHub subscriptions: runs the checkout and customer portal, processes payments, issues invoices and receipts, and collects taxes. Receives the subscribing organization's ID, the buyer's email address and the billing and payment details entered at checkout, which it processes as an independent controller. Its checkout is loaded only on the Subscription page and receives visitors' IP address and browser information United Kingdom (company); processes data internationally PCI DSS Level 1
Amazon Web Services (Amazon SES, Amazon CloudFront) Sends the Service's emails (email confirmation, password resets, invitations, and notices about accounts, approvals, requests, support and subscriptions): receives each recipient's name and email address and the content of the email. Serves the images shown in emails, receiving the reader's IP address and email client information when they load Canada (ca-central-1) SOC 1/2/3, ISO 27001
jsDelivr Delivers the icon font used by the web pages (receives visitors' IP address and browser information) Global CDN —
public-email-providers-domains (GitHub) Open-source list of public email provider domains (MIT license), copied into the application and used to tell company email domains from public ones at sign-up. No customer data is sent to it Bundled with the application —

Security policies

Information Security Policy
Roles, principles, data classification, personnel device rules and secure development.
Access Control Policy
Least privilege, MFA on every production path, quarterly access reviews, offboarding within 24 hours.
Incident Response Plan
Severity levels, containment and recovery steps, customer and regulator notification, post-incident reviews.
Backup and Recovery Policy
Daily backups, 30-day retention, 24-hour recovery objectives, quarterly restore tests.
Vulnerability Management Policy
Automated scanning, patch timelines by severity and handling of vulnerability reports.

Full policies are available to customers and prospective customers on request at security@bordershub.com.

Related documents