Controls we can describe precisely.
Multi-tenant architecture, vendor and client separation, role-based access, MFA, session controls, audit logs, encrypted secrets, purpose-separated email, and phishing simulations that collect nothing.
- Multi-factor authenticationAvailable
- Tenant isolationAvailable
- Audit loggingAvailable
- Encrypted SMTP secretsWith configuration
Each control, with its current state.
- Available now
- Available with configuration
- In development
- Planned
- 01Available now
Authentication
Password-based sign-in with protections against abuse.
- Email and password login
- Password hashing
- Access tokens and refresh tokens
- Token revocation
- Transparent session refresh
- Logout
- Password complexity and password change
- Login rate limiting
- Account lockout after repeated failures
- 02Available now
Multi-factor authentication
Time-based one-time passwords.
- TOTP setup
- QR-code enrollment
- Verification
- MFA login challenge
- Disable workflow
- 03Available now
Session security
Short-lived sessions that end when they should.
- Session expiration
- Idle timeout
- Short-lived access tokens
- Refresh-token lifecycle
- Revocation after security-sensitive changes
- 04Available now
Role-based access control
Access determined by who you are, what you own, and what your package enables.
- User role
- Vendor ownership
- Client ownership
- Assigned package
- Enabled modules
- Administrative privileges
- 05Available now
Tenant isolation
Vendors and clients are separated across supported modules.
- Clients
- Assessments
- Scan targets
- Findings
- Agent data
- Network devices
- Training modules
- Campaigns
- Documents
- Email settings
- Tickets
- 06Available now
Audited impersonation
Platform administrators can enter a vendor-scoped support session where authorized.
- Start impersonation
- Preserve the administrator session
- Record the support action
- Restrict the view to the selected vendor
- Support nested client views
- Exit and restore the administrator session
- 07Available now
Audit logging
A record of who did what, where, and when.
- Actor and role
- Action and status
- Resource
- IP address
- User agent
- Timestamp
- Relevant metadata
- 08Available with configuration
Email and secrets
Purpose-separated email profiles with encrypted credentials.
- Purpose-specific SMTP profiles
- Encrypted SMTP password storage
- TLS requirements
- Protection against private or unsafe SMTP hosts
- Phishing SMTP never falls back to platform SMTP
- Private document and file storage with database-controlled access
- 09Available now
Phishing simulation safety
Simulations that measure awareness without harvesting anything.
- No credential collection
- No password capture
- No login-form submission storage
- Pre-click reporting
- Safe simulation landing pages
- Campaign-specific tracking tokens
- 10Available with configuration
Responsible use of AI
AI supports selected workflows and does not replace qualified professionals.
- Drafting and summarization
- Question organization
- Remediation guidance
- Security analysis
- Human review before production changes
NoteAI-assisted recommendations are provided to support qualified professionals. Customers should review recommendations and validate changes before applying them to production environments.
What we say, and what we do not claim.
Scope of results
CSpace 360 supports cybersecurity management, assessment, monitoring, and remediation workflows. Results depend on configuration, scope, connected data sources, installed agents, and customer authorization. CSpace 360 does not guarantee prevention of every cyberattack and does not replace independent professional judgment, penetration testing, legal advice, or certification audits.
Frameworks
CSpace 360 helps organizations assess, organize, and monitor their alignment with selected cybersecurity and information-security frameworks. Certification and regulatory acceptance depend on the relevant authority, auditor, assessor, scope, evidence, and organizational implementation. CSpace 360 does not certify your organization as compliant.
AI-assisted output
AI-assisted recommendations are provided to support qualified professionals. Customers should review recommendations and validate changes before applying them to production environments. AI is not required to use the platform.
Response actions
Recommended response actions are presented for review. Sensitive actions require approval. CSpace 360 does not perform autonomous containment or automated patch deployment unless that capability is confirmed and configured for the production release.
Ask us the detailed questions.
Architecture, tenancy, data handling, agent authorization, and email separation: we will answer them directly in a technical session.