Security
The essentials in 5 points
- Each garage’s data is isolated from the others’: every access is checked against the garage and the role of the logged-in person, on every page and every action.
- All exchanges are encrypted (HTTPS required); passwords are never stored in clear text; sessions are signed, limited to twelve hours and revocable.
- A complete backup of each garage is made every night (the last 14 are kept), with no password or secret inside; the owner can also back up and restore by themselves.
- The automatic messages received from our providers (telephony, payment, emails) are checked by signature before being processed; a security log keeps logins, lockouts and administrator actions.
- What is not yet in place, said honestly: no certification, no external security audit, no two-factor authentication for garage accounts (it exists only for Praz SI administrators).
This summary helps you understand; it does not replace the full text below.
Isolation between garages
Every piece of data is attached to a garage. For every page and every action, the server checks that the logged-in person belongs to that garage and that their role (owner, deputy, team member, read-only) allows it. A garage can neither read nor modify another garage’s data, even by forcing an address.
Files (photos, PDFs, recordings) are accessible only to the garage concerned, and to the customer holding a signed link for what concerns them (quote, repair tracking).
Login and accounts
Passwords are hashed with a recognised algorithm; nobody, not even Praz SI, can read them. Sessions are signed tokens, valid for twelve hours, in a cookie inaccessible to the page’s scripts and sent only over an encrypted connection.
Login attempts are limited (per address and per account); an account is temporarily locked after too many failures. Password reset, invitation and unsubscribe links are signed and time-limited.
To accept a contractual document, a one-time code is sent by email; it is never stored in clear text.
Encryption
All exchanges between you and Praz SI, and between Praz SI and its providers, are encrypted (HTTPS, with the obligation to stay on HTTPS for one year for this domain). Configuration secrets (provider keys) are kept out of the code, in the host’s environment.
Encryption at rest: according to our host’s data processing agreement, its databases are encrypted (AES standard). Praz SI adds no encryption of its own to stored data, and promises nothing more than what the host publishes.
Backups
A complete backup of each garage is made automatically every night; the last fourteen are kept, separately from the main database. The garage owner can make one at any time, download it and restore the garage to a given date; a safety backup is made before any restoration.
No backup is kept for more than thirty days. When the garage permanently erases a customer’s data, it is also removed from all the backups already made.
A backup never contains a login account, a password, a token or an encrypted secret.
Site updates are preferably made at night, with a backup beforehand and automatic rollback if a problem is detected.
Automatic messages from providers
Telephony, payment and email providers send Praz SI automatic messages (call ended, payment received, email delivered). Each one is checked by signature or secret token before being processed, and a replayed message is ignored. The addresses from which Praz SI fetches a file (for example a recording) are checked so as never to reach an internal address.
Log and monitoring
A security log keeps successful logins, lockouts, password changes, the actions of the Praz SI administrator on a garage, restorations and permanent erasures, without ever writing a password, a token or a cookie in it; the email address is masked there. The administrator’s actions on a garage are also visible to the owner in the garage’s activity log.
The site monitors itself (health checks, corrective file) and reports anomalies to the Praz SI administrator.
Browser protections
The pages forbid the browser from loading a script, an image or a style sheet from another site, from being displayed inside another site’s frame, and from using geolocation or payment; microphone and camera are allowed only for the site’s functions (dictation, photos of parts).
Sia’s public chat has rate limits per conversation and per address (irreversible fingerprint), a capped message size and a filter against hijacking attempts: a visitor’s text is never an instruction.
What is not yet in place
No certification (ISO 27001, SOC 2, HDS) and no security audit by a third party to date. Two-factor authentication (code from an app) exists for Praz SI administrator accounts, not yet for garage accounts. Our providers’ certifications are theirs: they do not amount to a certification of Praz SI.
We prefer to say so rather than to imagine it: this page is updated with each step forward.
Report a vulnerability
If you discover a security vulnerability, write to contact@praz.si with as much detail as possible, without exploiting the vulnerability or accessing other people’s data. We acknowledge receipt quickly, fix it as a priority and keep you informed. We do not take legal action against a person who reports in good faith.
This English translation is provided for convenience. In case of discrepancy, the French version of this document, published at praz.si/juridique, prevails.