Security at Sponsoro

Sponsoro is sponsor licence compliance software for UK employers. We process sensitive immigration, Right to Work, salary and personnel data on behalf of licensed sponsors. Security is not an add-on — it is built into how we design, build and operate the platform.

This page describes the technical and organisational measures we use to protect data across sponsoro.co.uk (marketing site and free tools) and app.sponsoro.co.uk (the Sponsoro application). It is intended for customers, key personnel, security reviewers and procurement teams evaluating Sponsoro.

For how we handle personal data and your privacy rights, see our Privacy Policy.

Sponsoro is a multi-tenant SaaS application. Each licensed sponsor organisation has its own isolated workspace. Customer data is stored in managed PostgreSQL (Neon), documents in private object storage (Cloudflare R2), and the application runs on Vercel with TLS termination at the edge.

Defence in depth

• Identity: first-party authentication with Argon2 password hashing, email verification and mandatory MFA for privileged roles
• Authorisation: role-based permissions and PostgreSQL row-level security (RLS) on every customer data path
• Transport: HTTPS everywhere with strict security headers (HSTS, CSP, frame denial)
• Storage: provider-managed encryption at rest; field-level encryption for MFA secrets and sensitive declarations
• Documents: private buckets, tenant-scoped keys, short-lived signed download URLs after auth checks
• Abuse prevention: rate limiting on authentication, exports and webhooks
• Integrity: hash-chained immutable audit log for compliance accountability
• Development: automated secret scanning, static analysis, integration tests and typed validation at every boundary

We do not outsource authentication to a third-party identity provider. Sessions, passwords and MFA are handled entirely within the Sponsoro application.

We classify data by sensitivity and apply controls proportionately. The table below summarises how different categories are handled in production.

User authentication

• Passwords hashed with Argon2 — never stored in plain text
• Email verification required before full account access
• Multi-factor authentication (TOTP authenticator app) required for Authorising Officer and Level 1 roles in production
• Optional “Keep me signed in” extends session duration to 30 days; default session is 24 hours
• Session cookies are httpOnly and SameSite=Lax; no session tokens in localStorage
• MFA secrets encrypted at rest with a dedicated encryption key (separate from the session secret)
• Optional Cloudflare Turnstile bot protection on sign-in and sign-up flows

Worker portal

Sponsored workers can access a limited portal to upload evidence or complete tasks via invitation links. Worker sessions use a separate cookie (sponsoro_worker_session) with scoped permissions — workers cannot access other workers' data or organisation-wide settings.

Team and account lifecycle

• Organisation admins invite team members with assigned roles
• Invitations can be revoked before acceptance
• Users can be suspended or removed; sessions are invalidated on removal
• All team changes (invite, revoke, suspend, role change) are recorded in the audit trail
• Production cloud console access (Vercel, Neon, Cloudflare) is limited to named individuals with MFA enforced

Multi-tenant isolation

Every query that reads or writes customer data runs inside a PostgreSQL session with row-level security (RLS) enforced. The application sets the organisation context from the verified user session — client-supplied organisation IDs are never trusted alone.

• Drizzle ORM with parameterised queries — no string-concatenated SQL
• Resource IDs from the client are always loaded with organisationId from the session in the WHERE clause
• Tenant isolation integration tests run on every pull request to main
• Background jobs use per-tenant isolation — one organisation failure does not abort processing for others

Roles and permissions

Sponsoro uses role-based access control aligned with sponsor licence responsibilities:

Permissions are enforced server-side on every action. The UI reflects permissions but does not grant access on its own.

In transit

• All public endpoints served over TLS (HTTPS)
• Strict-Transport-Security (HSTS) enabled in production
• Content-Security-Policy with upgrade-insecure-requests in production
• Webhook and cron endpoints authenticated with dedicated secrets — not browser cookies

At rest

• Neon PostgreSQL: provider-managed AES-256 encryption
• Cloudflare R2: provider-managed encryption for stored document bytes
• Application field-level encryption for TOTP/MFA secrets and key-personnel conviction declarations
• Secrets (API keys, encryption keys, webhook secrets) stored in Vercel environment variables — never committed to source control

Secret management

Production environment variables are validated at build time. Critical keys (session secret, TOTP encryption key, database URL) must be present and correctly configured before the application starts. CI runs Gitleaks secret scanning on every pull request.

Compliance documents — passports, visas, contracts, payslips and similar evidence — are among the most sensitive data Sponsoro handles.

Storage

• Files stored in a private Cloudflare R2 bucket — no public URLs
• Storage keys are scoped by organisation ID
• Downloads require authenticated session (or valid worker portal session) plus organisation ownership check
• Signed download URLs are short-lived
• Document metadata (filename, type, upload time, uploader) stored in PostgreSQL under RLS

Upload validation

Every upload is validated before storage. Sponsoro supports two scanning modes configured per environment:

Rejected uploads (wrong type, failed scan, malware detected) are logged as security events. Files that fail validation are never stored.

Sponsoro maintains an immutable, hash-chained audit log for compliance accountability. This supports sponsor licence record-keeping obligations and internal investigations.

What is logged

• Worker record creation, updates and deletion
• Document uploads and access
• Team member invitations, role changes, suspensions and removals
• Right to Work checks and rechecks
• Salary compliance actions and sync events
• Reporting submissions and deadline changes
• Visit readiness self-audit snapshots
• Vacancy and recruitment evidence changes
• Data export and privacy requests

Integrity

Each audit entry includes a cryptographic hash linked to the previous entry, forming a tamper-evident chain. The audit trail can be viewed in-app and exported for Home Office visits or internal review. Export actions are themselves audited and rate-limited.

Sponsoro follows secure development practices designed to prevent common web vulnerabilities and maintain tenant isolation as the codebase evolves.

Development lifecycle

• All changes via pull request with code review — no direct pushes to main
• CI pipeline: Gitleaks secret scanning, Semgrep static analysis, ESLint, TypeScript, unit tests, integration tests, production build
• Zod validation at every server action and API route boundary — untrusted input is never cast without parsing
• Tenant isolation integration tests on every merge to main

Threat controls

Security headers

All responses include:

• Content-Security-Policy
• Strict-Transport-Security
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy (camera, microphone and geolocation disabled)

Development-only routes (/dev/*) return 404 in production.

We recommend EU/UK regions for Neon and Upstash when serving UK sponsor customers. Infrastructure providers maintain their own physical datacenter security, patching and compliance certifications — see their trust centres for details.

Sponsoro acts as a data processor for worker and key personnel data uploaded by customers. We use carefully selected subprocessors to deliver the service.

Always-on production subprocessors

• Vercel — application hosting
• Neon — PostgreSQL database
• Upstash — rate limiting
• Cloudflare R2 — document storage (when configured in production)

Feature subprocessors (when enabled)

• Stripe — subscription billing
• Google Workspace (Gmail) — transactional email
• Cloudflare Turnstile — bot protection
• Anthropic — AI Copilot completions
• OpenAI — RAG embeddings for AI guidance search
• ClamAV host — malware scanning on uploads
• Inngest — background job orchestration (when configured)

Vendor governance

• Machine-readable subprocessor register maintained in source code and reviewed quarterly
• No new subprocessor handling personal data without security review
• Customers notified at least 30 days before adding a new subprocessor that processes personal data
• Annual vendor review: DPAs, security reports, data region confirmation
• AI providers (Anthropic, OpenAI) receive only the minimum context needed for the requested feature — customer data is not used to train third-party models

A Data Processing Agreement (DPA) is available for enterprise customers. Contact privacy@sponsoro.co.uk for DPA requests.

Logging

• Structured security events: authentication failures, upload rejections, webhook verification failures
• Personal data redaction in logs — passport numbers and document contents are never logged
• Optional long-retention log ingest for operational and security analysis
• Audit log hash chain integrity can be verified in-app

Health checks

Production exposes liveness (/api/health) and readiness (/api/health?ready=1) endpoints to distinguish application vs database issues.

Incident response

We maintain an internal incident response runbook with defined severity levels, containment procedures and notification timelines. In the event of a personal data breach likely to affect individuals' rights, we notify affected customer organisations (as data controllers) without undue delay and comply with UK GDPR reporting obligations to the ICO where required.

• SEV-1 (cross-tenant data leak, DB exposure): immediate response within 15 minutes
• SEV-2 (suspected unauthorised access, scan bypass): response within 1 hour
• Evidence preserved: deployment IDs, request IDs, audit log entries, webhook records
• Annual tabletop exercise and restore testing

Backup strategy

Recovery objectives (internal targets)

Graceful degradation

• Isolated route error boundaries — one page failure does not crash the entire application
• Background jobs run independently — retention and privacy jobs do not block each other
• Multi-tenant job isolation — one organisation failure does not stop jobs for other tenants

Restore procedures are tested at least annually. An untested backup is not treated as a reliable control.

AI Copilot

• Optional feature — organisations control whether team members use it
• Completions powered by Anthropic; embeddings by OpenAI for guidance search
• Only the minimum context needed for the query is sent to AI providers
• AI outputs are informational — not immigration advice or automated compliance decisions
• Customer data is not used to train third-party AI models

External data sources

• UKVI sponsor register — public CSV for licence lookup (no customer data sent)
• Companies House — register lookups where configured
• GOV.UK guidance — referenced for compliance guidance; no worker PII transmitted
• Postcodes.io / Photon — address geocoding for compliance checks

Planned integrations

Integrations such as IDSP Right to Work verification, payroll sync (Xero, Sage) and enterprise SSO are listed in our product roadmap. Each requires a security review and subprocessor assessment before production API keys are added.

Sponsoro provides the platform; licensed sponsors remain responsible for lawful processing of worker data and sponsor licence compliance. Customers should:

• Enrol MFA for Authorising Officer and Level 1 users before operational use
• Assign roles using least privilege — not every user needs Level 1 access
• Revoke access promptly when staff leave or change role
• Provide privacy notices to workers whose data is uploaded to Sponsoro
• Use strong, unique passwords and do not share account credentials
• Report suspected unauthorised access to privacy@sponsoro.co.uk immediately
• Review audit trail exports periodically as part of internal compliance checks
• Ensure uploaded documents are necessary and proportionate for compliance purposes

Sponsoro is designed to support UK GDPR obligations and sponsor licence record-keeping requirements. Our security programme is aligned with SOC 2 control areas and we maintain internal documentation for security policy, data mapping, retention, subprocessors, incident response and secure development.

Current status

• UK GDPR: privacy policy, DPA available, data subject request tooling in-app (Profile → Data & privacy)
• Data residency: EU/UK region selection supported for database and rate limiting
• Penetration testing: scheduled as part of our security programme (contact us for latest report under NDA)
• SOC 2 Type II: not yet certified — controls documented and evidence collection in progress

We are happy to complete security questionnaires, provide our subprocessor list, or discuss our controls with your information security team under a mutual NDA.

If you discover a vulnerability in Sponsoro, suspect unauthorised access to your account, or have a security question for our team, please contact us:

• Email: privacy@sponsoro.co.uk (security and privacy enquiries)
• For urgent account compromise: disable the affected user in Team settings and contact us immediately
• For vulnerability reports: please include steps to reproduce and affected URLs/endpoints

We aim to acknowledge security reports within two business days and will keep you informed of investigation progress for reports affecting your organisation.

For personal data and privacy rights, see Your rights in our Privacy Policy. Key personnel users can also manage exports and erasure requests from Profile → Data & privacy in the application.