Security & Trust

We take security seriously. Tickets by Sam-Antics includes practical access, organization-scoping, and audit controls.

Data & Attachments

Organization Separation

Organization scoping and role checks help limit access to authorized district records.

Protected Attachments

Attachments are stored privately and served through permission-checked application routes. User-submitted ticket attachments have a 10 MB per-file limit and block certain executable and script-capable extensions.

Audit Trail

Key ticket actions and changes are logged, helping teams review what happened and when.

Secure Hosting (HTTPS)

Traffic is served over HTTPS.

Access Control

Role-Based Permissions

Role/group-based permissions help align access with responsibilities for End Users, Agents, Organization Admins, App Admins, and legacy Superusers.

Service Area Isolation

Service-area permissions limit agent access to their assigned Technology or Facilities tickets.

Session Timeout

Authenticated sessions expire after a configured period without application requests.

Password Security

Passwords use secure hashing and validation rules. Admins can require a password change when needed.

Google Sign-In (Optional)

Supports Google Workspace sign-in for districts that prefer single sign-on.

Application Security

CSRF protections are enabled to help prevent common web attacks.
Hosted application traffic is served over HTTPS.
Secrets are stored as environment variables (not hardcoded in the codebase).
Administrative actions are restricted by role.

Menu