Soteria Consult handles ledgers, payroll and tax records for churches, schools, hospitals, NGOs and corporates. Every one of those records is protected by layered technical and operational controls — described here in full, without marketing gloss.
Each control below is implemented, owned by a named individual, and produces evidence we can hand to your auditors.
Every request to Soteria properties and the client portal is served over HTTPS with modern TLS and automatic certificate renewal.
Portal accounts can be protected with a second factor, and 2FA can be enforced organisation-wide by an administrator.
Access is granted by role, not by exception. Roles are stored server-side and evaluated on every request.
A tamper-evident, append-only record of who did what, when, and from where — retained for the life of the engagement.
Client data is backed up continuously with point-in-time recovery, so a bad day never becomes a lost quarter.
A written recovery plan with tested restore paths, defined targets and a named owner per engagement.
Sessions are short-lived, revocable and visible. Users and administrators can see and terminate active devices.
Client financial records are encrypted in transit and at rest, with sensitive fields protected at the application layer.
Public forms and authentication endpoints are protected against automated abuse and credential stuffing.
Uploaded documents are scanned and constrained before they ever touch a reviewer's workstation.
Every endpoint authenticates, authorises and validates. Nothing sensitive is trusted from the browser.
Granular, revocable consent captured before any optional cookie is set — with the record kept.
A single place to see what we hold, why we hold it, and how to exercise your rights over it.
Administrators invite, suspend and offboard members without raising a support ticket.
One console for people, roles, sessions, security posture and compliance evidence.
Continuous monitoring of authentication and data-access patterns, with alerting on anomalies.
Modern, evidence-based password rules — length and breach screening over arbitrary complexity theatre.
Evidence packs your auditors will accept, produced from live system records rather than reconstructed after the fact.
Domains covered · Transport · Identity · Access · Data · Perimeter · Privacy · Administration · Assurance · Resilience · Engineering
Principles are only useful when they constrain decisions. These constrain ours.
New members receive the narrowest role that lets them work. Elevation is explicit, time-aware and logged.
Perimeter, application, database and operational controls each assume the layer in front of them may fail.
Encryption, row-level authorisation and audit logging are switched on at provisioning, not added later.
Preparation, review and approval sit with different people. No single individual can move value unobserved.
Every control we claim produces a record. If it cannot be evidenced, we do not present it as a control.
Backups are only credible once restored. Restore rehearsals are scheduled, not improvised during an incident.
No provider can promise nothing will ever happen. We can promise exactly what happens next.
Monitoring, alerting and client reports feed a single intake channel.
Severity assigned within the hour; a named incident lead takes ownership.
Access revoked, sessions invalidated and affected systems isolated.
Affected clients informed with facts, scope and interim mitigations.
Root cause fixed, controls strengthened, evidence retained.
Written post-incident report with actions, owners and dates.
Found a vulnerability in a Soteria property? Report it to soteriaconsultltd@gmail.com. We acknowledge reports within one business day and will not pursue researchers acting in good faith.
Straight answers to the questions that hold up vendor onboarding.
A senior partner and our security lead will complete it, walk your team through the control library, and provide the evidence pack your auditors need.
