Security & accountability
Boundaries around the register, and a record of who crossed them.
A system that holds a licence list needs clear rules for who can read it, who can change it, and how a finding was produced. These principles guide the architecture. They are not a certification.
Architecture and access
Explicit boundaries.
Accountable access.
The application foundation includes organization-scoped authentication, tenant memberships, and row-level security policies on both reads and writes, covering the authorization register. Roles govern privileged operations, and the organization a request acts in is a server-held selection rather than anything a client can assert.
Tenant isolation
Reads and writes are both constrained by row-level policies in the database, so the boundary holds even if application code is wrong. A privileged path remains for staff provisioning and offboarding; it carries an explicit organization scope.
Least-privilege access
Administrative and data-changing actions require permitted roles. What a viewer can see and what an owner can revoke are different questions, and the policies treat them that way.
Data handling
Agree the necessary data, retention and deletion requirements before any register is loaded. A first sitting should be a sanitized extract.
Traceability
Confidence comes
from the citation.
Source citations and rule provenance support review of every finding. Gap detection is deterministic. A person decides the outcome. Anything drafted by a model is labelled as such.
Human review
A finding exists because the matrix said so. Applicability, decisions and closure stay with a named person.
Deployment review
Encryption, hosting region, access controls, retention and logging are reviewed against the proposed deployment before customer data is connected.
Assurance claims
Interlockd does not currently claim SOC 2 or ISO certification. Security documentation and the scope of available controls can be discussed during diligence.
If this is your problem
Tell us where the register stops matching the floor.
What states you hold, what your locations actually do, and which licences you would check by hand before an exam.