Built for businesses that can't afford a breach
OneScale is designed with enterprise-grade security controls from day one — not bolted on after a compliance audit. Here's exactly what protects your data.
Argon2 PIN Hashing
LiveStaff PINs are hashed with Argon2id (memory-hard, GPU-resistant) before being written to disk. Plaintext PINs never leave the application layer. Default credentials are disabled — first login forces a unique PIN setup.
AES-256-GCM Encrypted Storage
LiveAll Zustand state written to localStorage is encrypted with AES-256-GCM. Keys are derived per-device and per-user via PBKDF2-SHA256 with 10,000 iterations. No raw auth tokens ever touch disk.
Two-Factor Authentication (TOTP)
LiveAdmin accounts can enforce TOTP-based 2FA (Google Authenticator, Authy, 1Password). Backup codes (10 single-use) are generated at enrollment and hashed with Argon2. 2FA is configurable per role.
Tamper-Evident Audit Log
LiveEvery security-relevant action is logged: login, logout, failed login, PIN change, permission change, data export, void, refund, high-discount, and cash drawer open — with user ID, timestamp, device, severity, and before/after values.
Rate Limiting & Brute-Force Protection
LiveLogin: 5 attempts per 60s per user, then account lockout. API endpoints: 200 req/min per tenant (Redis-backed). Onboarding and billing endpoints have tighter limits. Tauri commands have in-process token-bucket guards.
Production Content Security Policy
LiveThe SaaS portal enforces strict CSP headers (no unsafe-eval, no third-party scripts, HSTS with preload, X-Frame-Options: DENY). Image sources are restricted to self and your S3 bucket. Report-only mode available for staged rollout.
Revocable Session Management
LiveUser sessions are tracked server-side with JTIs. Logout marks the session as revoked. "Log out all devices" invalidates all active sessions. Inactive sessions expire automatically.
OS Keychain for Sync Tokens
LiveCloud sync pairing tokens are stored in the OS keychain (Windows Credential Manager, macOS Keychain, Linux Secret Service) via the keyring crate — never in plaintext config files.
SOC 2 Type II Roadmap
Controls implemented or in-progress for Type II certification.
CC6.1 — Logical access
Argon2 hashing, PIN complexity enforcement, account lockout
CC6.2 — Authentication
TOTP 2FA, backup codes, session JTI revocation
CC6.3 — Authorisation
RBAC (cashier / manager / admin) enforced at command layer
CC7.2 — System monitoring
Tamper-evident audit log with severity classification
CC8.1 — Change management
Immutable migration history, git-signed releases
A1.2 — Availability
Offline-first SQLite, cloud sync with conflict resolution
C1.1 — Confidentiality
AES-256-GCM at rest, TLS 1.3 in transit, CSP enforced
PI1.5 — Data retention
Configurable retention policy; GDPR data-export & delete commands
Formal SOC 2 Type II audit planned for H2 2025. Interim: pen-test reports available under NDA. Contact security@onescale.io.
Encryption at rest
SQLite DB encrypted via SQLCipher on paid plans. All cloud-synced data is AES-256-GCM encrypted before transmission.
Encryption in transit
All API calls use TLS 1.3. HSTS with preload enforced on the portal. Certificate pinning available for the desktop app.
Incident response
Security issues responded to within 24h. Critical vulnerabilities patched within 72h. Customers notified via in-app alert and email.
Have a security question or concern?
Responsible disclosure, pen-test reports, and security questionnaires:
security@onescale.io