🔒

Security & Compliance

La sicurezza non è un optional. È il fondamento del nostro prodotto.

Vulnerabilità Critiche

98/100

Security Score

161

Dependencies Scanned

🛡️ Latest Security Audit

9 Gennaio 2026 • Quarterly Security Assessment

✅

PASS

Overall Status

🎯

OWASP Top 10

Compliant

🔍

Snyk Verified

Zero Vulnerabilities

✅ All Security Issues Resolved

✓Security Headers: CSP, HSTS, X-Frame-Options implementati
✓Input Sanitization: DOMPurify + validator.js su tutti gli input
✓Rate Limiting: Protezione globale contro DoS e brute force
✓Error Handling: Zero information disclosure in production

📄 Download Full Audit Report (Markdown)

📜 Compliance Standards

🇪🇺

GDPR

✅ COMPLIANT

Art. 25 (Privacy by Design), Art. 32 (Security), Art. 33 (Breach Notification). Data retention policies, right to erasure implemented.

🇮🇹

CAD

✅ COMPLIANT

Codice Amministrazione Digitale - Audit trail 10 anni, firma digitale, conservazione sostitutiva.

🔐

eIDAS

✅ COMPLIANT

Electronic Identification and Trust Services - Firma digitale qualificata, OTP verification.

💳

PSD2

✅ COMPLIANT

Strong Customer Authentication - OTP via email, MFA per accesso dashboard.

📊

ISO 27001

🔄 IN PROGRESS

Information Security Management - Certification planned Q4 2026.

🏢

SOC 2 Type II

📅 PLANNED

Service Organization Control - External audit planned Q3 2026 for Enterprise customers.

🔐 Technical Security Controls

🔒 Encryption

✓ TLS 1.3 encryption in transit
✓ AES-256 encryption at rest
✓ HSTS with preload
✓ Certificate pinning (production)

🚫 Attack Prevention

✓ SQL Injection protected (Prisma ORM)
✓ XSS auto-escape (React + DOMPurify)
✓ CSRF tokens (NextAuth)
✓ Clickjacking prevention (X-Frame-Options)

⚡ Rate Limiting

✓ API: 100 requests/minute per IP
✓ Auth: 5 attempts/15min per IP
✓ Forms: 3 submissions/15min
✓ DDoS protection via Vercel Edge

👤 Authentication

✓ Multi-factor authentication (MFA)
✓ Bcrypt password hashing
✓ OTP verification (6-digit, 10min TTL)
✓ Session management (NextAuth)

📝 Audit & Logging

✓ 10-year audit trail retention
✓ IP address logging
✓ Document integrity (SHA-256)
✓ Geolocation tracking

🏗️ Infrastructure

✓ Tenant isolation (row-level security)
✓ Database backups (daily)
✓ Disaster recovery plan
✓ Uptime monitoring (99.9% SLA)

🛡️ Penetration Testing Program

🔍 Testing Methodology

▶OWASP ZAP: Automated vulnerability scanning
▶Snyk: Dependency & container scanning (161 packages)
▶Manual Testing: API fuzzing, IDOR, authentication bypass
▶Code Review: Static analysis di tutto il codebase

📅 Testing Schedule

✓Quarterly: Full penetration test
✓Weekly: Automated dependency scanning
○Pre-Release: Security regression testing
○Continuous: GitHub CodeQL analysis

🎯 Latest Results - Q1 2026

Critical

High

Medium

Low

🔒 Responsible Disclosure Policy

Se trovi una vulnerabilità di sicurezza, ti chiediamo di segnalarcela in modo responsabile. Offriamo riconoscimenti pubblici e bug bounties per segnalazioni valide.

📧 Contact Security Team

Email: security@fatturazione.app

PGP Key: Coming soon

⏱️ SLA Response: 24 ore per vulnerabilità critiche, 72 ore per high-severity

🔐 Security-First SaaS

Scegli una piattaforma dove la sicurezza non è un compromesso

Richiedi Demo Live Esplora Features