Skip to content

Security

Built so a record can answer for itself.

What protects the work and records people keep in Vantage, how one Unit Instance is kept apart from another, and how to tell us about a weakness.

Updated October 7, 2026

At a glance

Passwords
15 characters or more, hashed with PBKDF2-HMAC-SHA256
Second factors
Passkeys, authenticator codes with recovery codes, or CAC/PIV
Organization sign-in
OpenID Connect, including Entra ID in commercial, GCC High and DoD clouds
Sessions
End after 15 idle minutes (10 for Lead Vantage Administrators); a background poll cannot keep one alive
Failed sign-ins
Three in a row pause the account for 15 minutes
Records
Private by default; shared with a unit only when the author chooses
History
Case histories and the audit log are hash-chained and signed
Third parties in the browser
None: no analytics, tag managers, ad scripts or remote fonts

Signing in

Every account has a password of at least fifteen characters, checked against common and repeated patterns and stored only as a PBKDF2-HMAC-SHA256 hash. A passkey (WebAuthn), an authenticator app with single-use recovery codes, or a Common Access Card adds the second factor. A deployment can also hand sign-in to its organization’s identity provider over OpenID Connect, with PKCE, a single-use state and nonce, and the token checked against the provider’s keys.

Sensitive changes (email, second factors, passkeys, the Unit Manager console) ask for the password again. Everyone can see the devices they are signed in on and end any of them. Vantage can require the DoD Notice and Consent Banner before anyone signs in, and the server enforces it, not only the page.

Who can see what

A Marine’s record is private until they share an entry with a unit. Leaders see what was shared with the units they lead, and the units beneath them; access flows down the chain of command and never up. Leaving a unit ends access to its work at once, and work that was held goes back to the queue with the reason recorded.

No role in the application, including a Unit Instance’s Unit Managers and Vantage staff, can open another person’s private entries. When a leader opens a member’s record, that is itself logged in the unit’s access log. Team totals drawn from fewer than three people are withheld so a total cannot be used to single someone out.

Integrity you can check

Every entry on a case is appended to a per-case chain that is sealed with a keyed hash and a signed head. Each day the heads are anchored in a hash-chained audit log of sign-ins, access and changes. The Unit Manager console verifies both chains; a changed, removed or inserted entry shows as broken, never as merely unsealed. Audit records can also be sent off the host to a syslog collector or SIEM as they are written.

Corrections are added, never edited in place: the original stays in the history, marked as corrected, and anything calculated from it is shown as stale.

In the browser

Pages carry a strict Content Security Policy (scripts only from this site, each inline script allowed by its hash), HSTS, and headers that forbid framing, cross-origin embedding and referrer leakage. The session cookie is HttpOnly, Secure and SameSite, and every change needs a header a forged cross-site request cannot send. Nothing is loaded from another site: fonts, icons and films are served from the deployment itself.

Files and imports

Attachments and imported spreadsheets and email have size limits, and a workbook is charged for its real expanded size, not what it claims. Vantage can scan every upload with ClamAV and refuse what could not be scanned. Imported email is shown with remote images and active content blocked.

For your ISSM

Vantage is an enterprise application built to be hosted on the Marine Corps Enterprise Network. Each command on it is a Unit Instance: its units, members, roster feed, retention schedules, legal holds and audit trail are its own and kept apart from every other Unit Instance’s. A deployment either shares one database among many Unit Instances or holds exactly one, in which case the database itself refuses a second.

  • Three kinds of authority, none implying another. Vantage Administrators run the service. A Unit Instance’s Unit Managers run its structure: members, units, roles and the roster feed, without reading Marines’ records, and none can give themselves more. Unit roles in the chain of command read what is shared with their units.
  • Vantage Administrators do not see inside a Unit Instance unless its Lead Unit Managers approve a request, which names a reason and lasts at most a day. That access is read-only, can be ended by a Lead Unit Manager at any time, and every step is in the Unit Instance’s own audit trail.
  • Grants can end on a date (an acting billet, a leave period), and anyone who manages roles can see why a person can do what they can.
  • It runs as one Node.js process behind TLS and makes no outbound requests by default. AI, the MARADMIN feed, mail and search-engine notices are each off until they are turned on, and an MCEN deployment will not start with a public-internet service such as a commercial mail API or search-engine notices switched on. The Vantage Administrator console lists every outbound connection.
  • When AI is turned on it goes only to GenAI.mil, the key stays on the server, and a request carries only the fields that workflow needs.
  • Records management is built in: retention schedules with their authority, legal holds that stop every path that could delete, and disposition evidence for every run.
  • A privacy-impact data inventory is generated from the live database schema, so it cannot quietly stop being true.
  • Every build is linted, type-checked and tested; dependencies are audited; a CycloneDX software bill of materials is published; the code is scanned with CodeQL and the image with Trivy; the base image is pinned by digest.

Vantage is an independent project. It holds no FedRAMP authorization and no Authority to Operate. The service runs on commercial infrastructure and is not accredited for classified information or Controlled Unclassified Information; do not enter either.

Report a vulnerability

If you find a weakness, please tell us privately before telling anyone else. Send it through the request form (no account needed), or to the contact in security.txt. Include the version (the address /api/health reports it), the steps to reproduce, and what an attacker could do with it.

We will not pursue or support legal action against anyone who reports in good faith, tests only against their own account or a local copy, avoids privacy violations and disruption, and gives us reasonable time to fix the problem before disclosing it. Please do not run automated scans against this site, try to reach other people’s data, or test denial of service.