Data Sovereignty & Privacy Architecture

Security operations inherently handle highly confidential data: unpublished vulnerabilities, client target infrastructures, and proprietary exploit vectors. blackLen is architected with strict data sovereignty and minimization principles.

---

Zero-Telemetry on Confidential Operations

We maintain a strict boundary regarding what data is processed:

1. Zero Engagement Data Harvesting: blackLen does not inspect, parse, index, or harvest your target asset inventories, checklist evidence notes, custom script contents, or payload strings for training models or telemetry.
2. Private Scopes: Target scopes, CIDR blocks, and vulnerability notes remain strictly isolated within your organization workspace boundary.
3. No Unsolicited Tracking: We do not inject third-party behavioral trackers or session replay tools into authenticated operator workspaces.

---

Multi-Tenant Data Isolation

In multi-organization environments:

• Object-Level Authorization: Every database query against projects, checklists, scripts, and payloads is scoped strictly by the requesting user's active organization and project memberships.
• Tenant Partitioning: Users belonging to Organization A cannot view, discover, or query any assets or projects belonging to Organization B.

---

Organization Activity Logging

For governance and internal tracking, blackLen records key organization workspace events:

• Member Management: Logs when members are invited, accepted, removed, or have their roles modified.
• Workspace Governance: Logs organization profile updates and administrative changes.
• Actor Attribution: Every log entry attributes the performing user, target user, action timestamp, and source IP address.

---

Transport & Credential Security

• Encryption in Transit: All traffic is enforced over modern TLS (TLS 1.2+ / TLS 1.3) with strong cipher suites.
• Credential Storage: User passwords are encrypted using industry-standard PBKDF2 with SHA-256 hashing.