Security

Refinery is designed to run inside your perimeter, on-premise or in your own cloud tenancy. There are no mandatory external service dependencies: the audit engine, the formal verification layer, the certificate generation and the governance portal all operate offline. Your COBOL does not need to leave your estate for Refinery to work.

Every audit produces a Change Contract PDF with a SHA-256 fingerprint computed over the binary output, stored alongside the record. The document cannot be altered without invalidating that hash.

Signing is fail-closed: an audit record that cannot be signed is rejected rather than stored unsigned, so tamper-evidence cannot be quietly opted out of. CRO sign-off is write-once: once a change is signed off, subsequent write attempts to that record are refused.

Accounts support multi-factor authentication, and tokens can be revoked. Actions are written to a hash-chained activity log, so removing or editing an entry breaks the chain and is detectable. In multi-tenant deployments, estate data is tenant-scoped.

Two checks (dynamic output equivalence and the exception-handler re-run) require GnuCOBOL to be present. If it is not, those checks are disabled, the active check count drops from 11 to 9, and every generated certificate says so explicitly rather than presenting a degraded run as a full one. The same applies to the parser: if the tree-sitter grammar is unavailable the engine falls back to heuristics and records which mode ran, all the way through to the PDF.

Where the product models rather than measures something (for example, estimated CPU savings in synthetic-telemetry mode), the result is machine-readably tagged as a calibrated estimate, not a measurement.

If you believe you have found a security issue in this website or in Refinery, email okeatilade@gmail.com, with enough detail for us to reproduce it. We will acknowledge your report within 3 business days and keep you updated while we fix it. We will not take legal action against anyone who reports an issue in good faith, avoids harming users or data, and gives us reasonable time to fix it before disclosing it. Our security.txt has the same details.

Refinery does not yet hold an independent security certification such as ISO/IEC 27001 or SOC 2. We will list a certification here only once we hold the audit report for it.