Trust Centre › 8. Security practices
Security practices
In short
Releases go through a deploy guard: a tool that builds from a recorded version, runs the checks first and stops if anything differs from what was reviewed. DIANO's server code runs on Node.js 24, a supported version, and Google applies security updates to it automatically.
Updates and patches
- DIANO's server code runs on Node.js 24, a supported version, and Google applies security updates to it automatically.
- Software libraries are updated by hand when DIANO releases changes. There is no automatic alert for weak libraries yet.
Testing before release
- New work is tested on a separate test system (staging) before it goes live. The database rules are checked against hundreds of test cases before every rules release.
- Releases go through a deploy guard: a tool that builds from a recorded version, runs the checks first and stops if anything differs from what was reviewed.
Watching for problems
- The platform owner gets e-mail alerts if the audit trail misses a change or its functions fail.
- There is no automatic check yet that warns when DIANO is down.
When something goes wrong
- DIANO's incident steps are written down: contain the problem, find out what was affected, tell the companies affected, fix it, and write up what happened.
Report a security problem
- To report a security problem, e-mail info@diale.co.za with "Security" in the subject line.
Please tell us before you tell anyone else, give us time to fix it, and never open or change other people's records while you look.
Not done yet
- No outside firm has tested DIANO's security yet (a penetration test).
- Some browser safety settings, such as a content security policy, are not switched on yet.
Roadmap: planned, not true yet
- Planned — target October 2026: An automatic outage check that alerts the platform owner.
- Planned — target December 2026: Automatic alerts for weak software libraries.
- Planned — target December 2026: More browser safety settings are switched on, such as a content security policy.
- Planned — target March 2027: An outside firm tests DIANO's security, and a summary letter is published here.
- Planned — target November 2026: A dedicated address for security reports: security@diano.co.za.
Targets can move. When an item is done, it moves up into the page with its proof. The whole roadmap.
For your IT team / auditor
Each statement on this page, how it was checked and when. Every check was read-only. The full evidence (commands and their output) is available to auditors on request.
| Statement | How it was checked | Checked |
|---|---|---|
| Releases go through a deploy guard: a tool that builds from a recorded version, runs the checks first and stops if anything differs from what was reviewed. | DIANO's deploy tools; DIANO's release checklist. | 2026-10-19 |
| DIANO's server code runs on Node.js 24, a supported version, and Google applies security updates to it automatically. | Google Cloud server functions (read-only check, 2026-10-20) (by runtime: nodejs24 99); Google Cloud logging and alerts (read-only check, 2026-10-20) (automaticUpdatePolicy present). | 2026-10-19 |
| Software libraries are updated by hand when DIANO releases changes. There is no automatic alert for weak libraries yet. | no .github folder and no dependabot or renovate configuration in the repository (git ls-files .github is empty, 19 Oct 2026); DIANO's Node.js 24 upgrade plan (manual upgrade). | 2026-10-19 |
| New work is tested on a separate test system (staging) before it goes live. The database rules are checked against hundreds of test cases before every rules release. | DIANO's release checklist; DIANO's deploy tools (rules gate, 688 cases on the staging line, build T report); release/staging run reports. | 2026-10-19 |
| The platform owner gets e-mail alerts if the audit trail misses a change or its functions fail. | Google Cloud logging and alerts (read-only check, 2026-10-20) (4 alert policies, enabled, 1 e-mail channel). | 2026-10-19 |
| There is no automatic check yet that warns when DIANO is down. | Google Cloud logging and alerts (read-only check, 2026-10-20) (uptime checks: 0). | 2026-10-19 |
| DIANO's incident steps are written down: contain the problem, find out what was affected, tell the companies affected, fix it, and write up what happened. | DIANO's written incident steps (this build). | 2026-10-19 |
| To report a security problem, e-mail info@diale.co.za with "Security" in the subject line. | DIANO's published pages (contact an owner account); DIANO's written incident steps. | 2026-10-19 |
| No outside firm has tested DIANO's security yet (a penetration test). | no penetration-test report in the repository or the run reports (19 Oct 2026); Jonathan to confirm (this build's report, decisions). | 2026-10-19 |
| Some browser safety settings, such as a content security policy, are not switched on yet. | Google Cloud connection test (read-only check, 2026-10-20) (no content-security-policy, x-frame-options or x-content-type-options header). | 2026-10-19 |