Strong identity
Passwords are stored with PBKDF2-HMAC-SHA256 and a unique salt per user. An authenticator app or an email code adds a second factor.
Security
Security principles for asset data that matters
Strong sign-in, least-privilege access, a tamper-evident record of every change, continuous monitoring and an application shield. Every setting is controlled by your administrators, and every change to a setting is itself recorded.
Our approach
Protection in layers, nothing weakened silently
Mintema protects business data with strong sign-in, least-privilege access, a tamper-evident record, continuous monitoring and an application shield. Security settings are central, and every change to them is recorded.
Least privilege
Permissions are set per action by role, with a separate permission for each security page. Every privilege change is recorded.
A tamper-evident record
Sign-ins, denials, configuration changes, writes, deletes and exports are logged in a hash-chained, append-only log.
Continuous monitoring
A separate security service watches for attack patterns and raises alerts that are assigned, acknowledged and escalated.
An application shield
Requests are inspected, rate-limited and blocked when needed, with an emergency lockdown switch.
You stay in control
Policies, thresholds, recipients and retention are set by your administrators without a software update.
In detail
What protects your data, layer by layer
Identity and access
Strong sign-in and access that is no wider than the job
A central password policy blocks common passwords and reuse, lock-out slows guessing, and a second factor can be switched from off, to report-only, to enforced for administrators or for everyone. Inactive accounts can be reported or disabled.
- Authenticator app or email code
- Lock-out and throttling per account and address
- Device approval for mobile access
Second factor policy
AdministratorsAuthenticator appEnforced
All usersMeasuring the impactReport-only
Inactive accountsDisabled after 90 daysOn
Audit log
A record that shows when it has been touched
Every sign-in event, access denial, configuration change, data write, delete and export is recorded with user, address, module, time and outcome. Entries are chained by hash and cannot be edited or deleted through the application, and a scheduled check raises a critical alert if the chain is broken.
- Old and new value of each changed field
- Search, drill-down and export for SIEM tools
- Viewing and exporting the log is recorded too
Each entry points at the one before
Entry 1Sign-inEntry 2Permission changedEntry 3Record editedCheckChain verified
Monitoring
Someone is always watching, and told when something is wrong
A dedicated service runs apart from the web application, so monitoring continues independently of web traffic. Detections include repeated failed sign-ins, surges against a 24-hour baseline, mass deletion, administrator sign-in outside working hours and a configuration changed outside the audited path.
- Notification bell and email at once
- Optional webhook for Teams, Slack or a SIEM
- Unacknowledged alerts escalate to named contacts
Security alerts
Repeated failed sign-insOne account · 14 addressesCritical
Administrator outside hoursSign-in at 03:12Open
Request floodBlocked for 60 minutesClosed
Shield
A filter at the door, and a switch for emergencies
The shield inspects requests for injection patterns, path traversal, scanner tools and oversized requests. It limits request rates, keeps block and allow lists, and runs in Detect or Block mode. In an emergency, lockdown makes the platform read-only or limits it to an allow list.
- Detect mode to measure before blocking
- Automatic blocking of repeat attackers
- Protection against blocking yourself
Shield
DetectBlockRate limitsBlock listAllow listRead-only lockdownAllow-list-only
Standards
Used as yardsticks, never as a claim
Mintema is designed to align with these standards and to support your own compliance work. Only an independent body can certify an organisation.
- 01
Map each control
Every control lists the standard requirements it addresses.
- 02
Show its real status
The control matrix states whether each control is implemented, partial, planned or a process of your organisation.
- 03
Keep it honest
Open items stay visible, because an honest list is more useful to a reviewer than a clean claim.
- 04
Support your audit
Logs, exports and settings give auditors the technical evidence they ask for.
Limits
What we say plainly
Trust comes from knowing where a control stops. These are the limits we state to every security reviewer.
What we do not claim
Not a network firewallNot a DDoS serviceTamper-evident, not tamper-proofNot certified by itselfNot a replacement for an audit
What helps close the gaps
- Safe coding remains the primary defence, the shield adds a layer
- External anchors and a least-privilege database login protect the log
- Supervise the security service with your own monitoring
- An independent penetration test and your own ISMS complete the picture
FAQ
Security, answered
Have a question that is specific to your organisation? A solution engineer will answer it against your own assets, processes and data.
Mintema is designed to align with and support these standards, but a certificate or a SOC 2 report is issued to an organisation by an independent body after an assessment of people, process and technology. We supply the technical evidence and an honest control matrix for your own assessment.
Yes. Administrators choose Off, Report-only or Enforce, for administrators or everyone, with a grace period. Authenticator app and email code are supported.
Not through the application. Entries are chained by hash and appended only, and a database trigger refuses updates and deletes. The log is tamper-evident rather than tamper-proof, so external anchors and a least-privilege database login are recommended.
Yes. Alerts reach the notification bell and email, and an optional secure webhook can feed Teams, Slack or a SIEM. The audit log exports as CSV or NDJSON.
It filters injection patterns, path traversal, scanner tools, sensitive file requests and oversized requests, and limits request rates. It is an application-level filter, not a network firewall or a DDoS service.
Planned items include server-side session revocation, a content security policy, recovery codes and WebAuthn, a breached-password check, a SIEM connector and an independent penetration test. The status of every control is visible in the control matrix.
A SECURITY REVIEW
Your questionnaire,
Your questionnaire,
answered with evidence.
Bring your security questionnaire. A solution engineer will walk through the controls, their status and the evidence for each.