PDPROJECTDONESELF-HOSTED CONSTRUCTION PMS
SECURITY & DATA OWNERSHIP

Your server.
Your data.
Our proof.

Everything below describes the exact bytes you download — not aspirations. Each mechanism is verifiable in the release package and in the live demo.

Data ownership

  • Self-hosted — the application and its database run on your hosting. We never hold your projects, hours, or invoices.
  • Zero telemetry — no analytics, no tracking pixels, no usage phone-home, no third-party beacons in the application.
  • Local license check — your license is a cryptographically signed key validated on your server. Activating it requires no account with us and no recurring connection to our infrastructure.
  • Zero external assets in the product UI — stylesheets and fonts ship inside the package; the application makes no runtime calls to CDNs for its own interface.

Audit integrity

  • SHA-256 hash chain — every audit-log row binds to the previous row's digest. Editing, deleting, or inserting history breaks the chain provably.
  • Serialized writes — chain appends run inside a transaction with a row lock, so concurrent actions can't fork the history.
  • On-page verification — the audit log re-verifies the full chain on every render and shows the result (green = intact, with row count).
  • Append-only posture — the audit log is write-once by design; there is no application path that edits it.

Release integrity

  • Per-file SHA-256 manifest — every release ships MANIFEST.sha256 covering all 4,327 files. You can verify the package byte-for-byte before installing.
  • Installer drill — before any release replaces the fulfillment bytes, it must pass a fresh-install drill: clean host, clean database, license-validated install, full module sweep, real PDF output.
  • Exact bytes served — the package you download is the package that passed the drill, hash-verified on delivery.

Access control

  • 5 roles, 85 permissions — Admin, Project Manager, Worker, Client, Accountant; least-privilege by default.
  • Project-level IDOR guards — financial and governance data is checked against project membership on every request, not just in menus.
  • TOTP two-factor authentication — standard authenticator apps, per user.
  • Forced password change — the installer issues a temporary admin password that must be changed at first login.
  • Password hashing — industry-standard one-way hashing (PHP password_hash).

Transport & headers

  • HTTPS enforced by the installer — installation requires a real HTTPS application URL.
  • Content-Security-Policy — default-src 'self', no object embeds, frame-ancestors locked, upgrade-insecure-requests.
  • HSTS — one-year max-age with subdomains, served on HTTPS.
  • X-Frame-Options / Referrer-Policy / Permissions-Policy — clickjacking, referrer leakage, and sensor access locked down.
  • Cookies — HttpOnly, Secure, SameSite=Strict.

Application layer

  • Prepared statements — all database access runs through parameterized PDO queries.
  • CSRF tokens — required and validated on every state-changing form.
  • Output escaping — view-layer escaping helper applied across templates.
  • Rate-limited login — failed-attempt lockout on the sign-in path.
  • Upload confinement — file uploads land in a dedicated storage area, never executed.
FOUND SOMETHING? — Report it to sales@projectdone.pro. We treat security reports as release-blocking until resolved.