Security & compliance
Money and stock move through Telos. We treat that responsibility seriously and document our posture in plain language.
Encrypted at rest, in transit, and on backups
Standalone uses SQLCipher (AES-256). LAN and online use Postgres-level disk encryption with TLS 1.3 between every component. Backups are encrypted with a customer-controlled key.
Append-only audit log with hash chain
Every state-changing action records actor, timestamp, before, and after. The chain hash is verified daily; tampering is detected within 24 hours.
Fine-grained RBAC
Permissions are declared at every endpoint, generated from a single matrix, and enforced on both runtimes. MFA is mandatory for admin and finance roles.
Recoverable
Nightly Postgres + MinIO backups on LAN. Continuous WAL replication on online. Tested restore drills published in our quarterly trust report.
Built for Afghan regulatory reality
The core is industry-neutral. Vertical obligations — MoH registration, certificates of analysis, controlled-substance ledgers, recalls — live in the industry pack, so a spare-parts shop is not forced through a pharmacy workflow.
The non-negotiables
- Default-deny on every endpoint
- Idempotency keys on every state-creating command
- No secrets in code; vault-backed in cloud
- No backdoor accounts. No remote support shells without explicit consent
Trust report
We publish a quarterly trust report covering uptime, restore-drill outcomes, and any security advisories. The most recent report is available on request — write to security@telos.lazuli.af.
- — None on record —
- 2026-04-12 · passed
- Daily, last verified 24h ago
- Required for admin and finance roles