Organisation isolation
Every protected query is scoped to the signed-in organisation and checked again against person-level access. A record identifier is never treated as permission.
Security
Discretion is an architectural decision.
Domivio handles precise location and deeply personal evidence. Security is designed into identity, data access, storage, sync and audit—not added at the edge of the product.
Least-privilege identity
Short-lived sessions, single-use sign-in links, device records, role permissions and revocation controls restrict access to the smallest necessary surface.
Private evidence
Document bytes remain in private object storage. Downloads are streamed only after organisation and person authorisation; folder names never determine access.
Append-only audit
Manual travel corrections, rule changes, uploads and approvals create immutable events with actor, source, time and before/after context.
Explicit location consent
Native tracking is opt-in, visible and reversible. Offline events are encrypted on device and synchronised with stable identifiers to prevent duplicates.
Defence in depth
TLS, encryption at rest, restrictive browser policies, private bindings, input validation, rate controls and structured redacted logs reduce single-point failure.
Clear boundary: these are the controls built into Domivio’s architecture. Domivio does not claim a certification until that certification has been independently completed and is current.
Data separation
Organisations, households and people have stable relational identifiers. Membership and person-level access grants are separate records, allowing a family office to authorise one adviser for one household without exposing another. Automated tests attempt cross-organisation reads and writes and require them to fail closed.
Location interpretation
Raw observations and interpreted journeys are deliberately separate. Coordinates are retained as factual inputs; country presence is a derived record with confidence and provenance. Aircraft-speed or high-altitude points default to air transit and do not become residency days. Uncertain movements remain uncertain until evidence or an authorised correction resolves them.
Evidence storage
R2 stores encrypted-at-rest object bytes under opaque keys. D1 is the source of truth for person, country, date, type, journey link, verification state and retention. Upload credentials are short-lived and single-use. Download responses are private and non-cacheable.
Operational controls
- Development contains synthetic records only.
- Cloudflare environments and account identifiers are explicitly pinned.
- Secrets are encrypted environment values and never committed to source.
- Production releases use migrations, dry runs, tests and live health verification.
- Security-relevant logs exclude raw tokens, document contents and precise coordinates.