Authentication
Separate management and individual investor authentication with session validation.
SN Shield · Trust & Security
AI With Enterprise Control.
SN Insight separates AI recommendations from sensitive execution using server-side authentication, permissions, business rules, approvals and audit controls. Deployment-specific security claims are published only after verification.
Control path
AI Action → Permission Check → Business Rules → Human Approval → Execution → Audit Trail.
The model is not the authority. Sensitive actions are governed outside the prompt by application logic and authorised systems.
AI ActionSuggested operation
PermissionUser/module access
RulesPolicy and thresholds
ApprovalHuman decision
ExecutionApproved operation
AuditRecorded result
Current website / portal controls
Security controls already represented in this codebase.
These describe implemented application-level controls in the current SN Insight website and investor workflow. Production infrastructure controls still depend on deployment.
Role-Based Permissions
Management actions are checked against server-side roles and permissions before protected actions execute.
Investor Authorisation
Private investor pages validate account status, expiry and per-module permissions.
Password Protection
Investor authentication uses salted PBKDF2 password hashes in the existing portal logic.
Audit Trails
Login, failed login, page-view, account-change and confidential-download events can be recorded with context.
Publishing Control
Venture drafts remain separate from published versions until approved publication actions complete.
AI Demo Governance
Investor Live AI Demo uses module permission, per-user limits, request logging and controlled demo data.
Private-Page Controls
Investor pages combine authentication with noindex/nofollow and no-store response controls.
Enterprise security model
Controls should follow the data and the action.
Production deployments should define identity, role, data separation, encryption, API access, approval requirements, logging, retention and recovery based on the client environment.
Least-privilege access to modules, records and actions.
Separate viewing, preparing, approving and administering.
Require explicit human decisions for sensitive transactions.
Record security and business events needed for accountability.
Keep tenant/client and private investor data isolated according to architecture.
Use deployment-appropriate transport and storage protection.
Authenticate integrations, restrict scope and monitor errors.
Control model access, permitted tools, data classes and outputs.
Keep people responsible for sensitive approvals and final decisions.