Security Whitepaper
How RanchPad protects your farm data — architecture, practices, and compliance.
Version 1.0 — January 2026
1. Executive Summary
RanchPad is committed to protecting the security, integrity, and availability of customer data. This whitepaper describes the security architecture, processes, and controls implemented across the platform. Our approach follows defence-in-depth principles with multiple layers of protection.
2. Infrastructure Security
Cloud Hosting
Hosted on enterprise-grade cloud infrastructure with ISO 27001, SOC 2 Type II, and PCI DSS certifications. Regional data centres in Oceania, Europe, and North America.
Network Security
Web Application Firewall (WAF), DDoS protection, and private VPC networking. All inter-service communication encrypted via mutual TLS.
Redundancy
Multi-availability-zone deployment with automated failover. Database replication with point-in-time recovery up to 35 days.
Backups
Automated daily backups with geographic redundancy. Backup encryption at rest. Regular restoration testing to verify integrity.
3. Application Security
Authentication
- Industry-standard password hashing (bcrypt with per-user salts)
- Optional two-factor authentication (TOTP)
- Account lockout after repeated failed login attempts
- Session management with secure, HTTP-only cookies
- OAuth 2.0 support for API authentication
Authorisation
- Role-Based Access Control (RBAC) with granular permissions
- Per-module permission enforcement (View, Create, Edit, Delete)
- Multi-tenancy with strict data isolation between organisations
- API keys with configurable scope and rate limits
Data Protection
- All data encrypted in transit using TLS 1.2 or higher
- Database encryption at rest using AES-256
- Sensitive fields (API keys, credentials) use additional application-layer encryption
- Anti-CSRF tokens on all state-changing requests
- Content Security Policy (CSP) headers to prevent XSS
- Input validation and parameterised queries to prevent injection attacks
4. Secure Development Lifecycle
| Phase | Security Activity |
|---|---|
| Design | Threat modelling, security architecture review |
| Development | Secure coding standards, peer code review, static analysis (SAST) |
| Testing | Automated security testing, dependency vulnerability scanning |
| Deployment | Container image scanning, infrastructure-as-code review |
| Operations | Runtime monitoring, intrusion detection, log analysis |
5. Incident Response
RanchPad maintains a formal incident response plan with defined roles, escalation procedures, and communication templates:
- Detection — Automated monitoring and alerting for anomalous activity
- Triage — Severity classification (Critical, High, Medium, Low)
- Containment — Immediate threat containment with minimal service disruption
- Investigation — Root cause analysis and evidence preservation
- Notification — Customer notification within 72 hours of confirmed data breach
- Recovery — Service restoration and security hardening
- Post-mortem — Lessons learned and preventive measures
6. Compliance & Certifications
- New Zealand Privacy Act 2020 compliance
- Australian Privacy Act 1988 / APPs compliance
- UK GDPR and Data Protection Act 2018 compliance
- PCI DSS compliance for payment processing (via certified payment processor)
- Annual third-party penetration testing
- Regular internal security audits
7. Audit Logging
RanchPad maintains comprehensive audit logs including:
- User authentication events (login, logout, failed attempts)
- Data access and modification events
- Administrative actions (user management, permission changes)
- API access and rate limit events
- Compliance submission audit trail
Audit logs are retained for a minimum of 12 months and are tamper-protected.
8. Responsible Disclosure
We welcome responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to security@ranchpad.co.nz. We commit to acknowledging reports within 48 hours and providing regular updates on remediation progress.