Fail closed
Tenant and company selections are checked against active access records before enterprise API operations execute. Forged or unauthorised selectors are denied.
MAESTRO Trust Center
Accounting data belongs to the customer. Access does not.
MAESTRO uses layered, server-enforced controls to protect accounting, banking, tax and operational information. Security decisions are based on authenticated identity and explicit organisation membership—not on a hidden menu or a company ID supplied by a browser.
Continuous security controls and isolation monitoring active
Least privilege
Named accounts, organisation memberships and role permissions limit each user to authorised business functions. Interface visibility never replaces server-side authorisation.
TLS 1.2 and 1.3
MAESTRO requires modern HTTPS transport, Secure and HttpOnly session cookies, HSTS and protections against clickjacking, MIME confusion and unsafe referrer disclosure.
Isolation is tested
Automated negative tests verify that foreign organisation and company identifiers are rejected. Authentication, permission and high-risk finance activity is designed to be auditable.
Defence in depth
Rate-limited authentication, CSRF protection, restricted browser origins, host validation, private configuration storage and dependency security reviews reduce the attack surface.
Controlled access
Backups and operational files are kept outside the public web root with restricted filesystem permissions. Data export and retention controls are part of the security programme.
Honest security, not an absolute promise
No responsible provider can claim that a complex system is impossible to attack. MAESTRO’s commitment is measurable controls, continuous verification, rapid remediation, transparent contractual responsibilities and independent assurance as the programme matures.
Security principles
- Zero implicit trust between organisations, users, integrations and services.
- Encryption and strong key management for sensitive information.
- Minimum necessary access, with additional controls for administrators and financial actions.
- Secure development, dependency review and recurring isolation testing.
- Recovery planning, protected backups and incident-response readiness.
- Privacy by design and GDPR-aligned technical and organisational measures.
For a security questionnaire, data-processing agreement or technical architecture review, contact your MAESTRO account representative. MAESTRO does not claim ISO, SOC or other independent certification until the relevant audit has been completed.