Identity & access
OpenID Connect authentication with a confidential client and PKCE. Organisation membership is the tenancy boundary, re-validated on every request; email is never the account key.
Platform
Secure by construction, not by claim
A concise, accurate description of how SolaMaxa protects projects, models and commercial data. We describe what is implemented — we don't collect compliance badges we haven't earned.
The foundation
Security pillars
Role-based access control
Typed roles — owner, admin, project manager, analyst, reviewer, viewer — with capabilities enforced server-side. Interface visibility is cosmetic; the server is authoritative.
Layered request protection
Same-site session handling with origin checks, security headers, content-type validation on uploads, and sliding-window rate limiting on sensitive routes.
Fail-closed configuration
Production refuses to start with insecure configuration — development authentication, missing secrets or permissive cross-origin settings fail startup rather than degrade silently.
Redacted, audit-logged operations
Logs redact identifying detail and never carry secrets; security-relevant events are written to an append-only audit stream.
Least-privilege boundaries
Platform-administration surfaces are isolated behind a dedicated system role, separate from customer organisation roles — organisation admins are never automatically system administrators.
Formal compliance certifications (for example SOC 2 or ISO 27001) are not claimed on this page. Where customer procurement requires evidence, we share the current security documentation directly in a demo or under NDA.
Commercial confidentiality
Your commercial data stays yours
RFQs, supplier responses, quotes and commercial decisions are project-confidential and access-controlled. One customer's pricing is never exposed to another — and de-identified pricing intelligence, where it exists as internal infrastructure today, is not exposed as a customer-facing benchmark.
See it on a building you know
Need security documentation?
Request a demo and we'll share the current security overview appropriate to your procurement process.
SolaMaxa is pre-beta. We are currently selecting the first architectural, BIPV, engineering and property teams.