Security & Deployment
Run SAFOPS hosted, on-premise, or fully air-gapped — with the access controls, audit integrity, and hardening a nuclear, defence, or rail procurement review expects.
Hosted, On-Premise or Air-Gapped Deployment
One container image, three ways to run it: hosted by SAFOPS with UK data residency, on-premise inside your own network, or fully air-gapped — including the optional AI copilot's local engine, so nothing about your safety case has to touch a network you do not control. The image is identical in every case; only the network it sits behind differs.
Multi-User Access Control
Multi-user accounts with per-project access grants, so each user sees only the projects they are assigned. An admin console for creating users, resetting passwords, unlocking accounts and adjusting access. Login lockout after repeated failed attempts, backed by a global rate limiter. Every change is attributed to a named user in the audit trail, and presence indicators show who else has a project open.
Tamper-Evident Audit Trail Integrity
Every edit, human or AI-suggested, is sealed into a SHA-256 hash chain. The audit log itself is HMAC-anchored, so the chain cannot be silently rewritten, and can be verified on demand. Time Machine reconstructs any past state from that trail, and Formal Issue snapshots freeze approved versions as permanent records.
Application Hardening
CSRF tokens and same-site checks on every state-changing route. Hardened Excel and Word parsing, tested against real entity-expansion and XXE payloads, with request size limits to close file-bomb attacks. Pinned dependencies, secrets kept out of source control, and no internal error text ever returned to a client. The codebase goes through repeated structured security reviews — authorisation, injection, race conditions, parser abuse — each backed by regression tests.
No Vendor Lock-In: Open Files and JSON Export
Projects live in open, inspectable Excel workbooks rather than a proprietary database. The whole project exports to machine-readable JSON, reports to Word, PDF and HTML, and the interactive map downloads as a standalone HTML file you can attach to an email. If you ever leave SAFOPS, you leave with everything. The same holds if SAFOPS ever leaves you: the workbook stays readable without our software, and source code escrow is available on request for programmes that need the engine guaranteed as well as the data.