News
How member and association information is protected
Military OS checks sign-in responses, keeps private fields off public pages, inspects uploaded images, and limits access to service credentials.
Sign-in checks
Account creation and sign-in are handled through the client's Amazon Cognito account. Cognito verifies the email address before Military OS creates an inactive person profile. Paid membership confirmation changes that profile to active.
After the person's identity is confirmed, Military OS checks their active status, staff role, and chapter assignment. An inactive signed-in account can reach membership checkout but cannot open administration pages.
Information on public pages
Public pages receive only the fields they need. Private fields from the full administration record are not sent to those pages.
Requests that change information are checked to make sure they came from the expected site and are within the allowed size. Website addresses are checked before they are saved.
Image uploads
Public image uploads are limited to five megabytes. Military OS checks the file itself for PNG, JPEG, GIF, or WebP content instead of trusting the filename.
Service passwords and database connections
Service passwords and other private settings are kept in AWS Systems Manager Standard Parameter Store. Each client installation can read only the settings it requires.
Connections to the hosted database must be encrypted. The Amazon RDS database is also configured to reject unencrypted connections.
Audit retention
Administration activity is grouped by month. The client's retention setting determines when older activity records are removed.
Screenshots show the product version available when this post was published.
Share
Subscribe
Subscribe to Military OS News.
Email stays separate from browser notifications. Use the inbox if you want the durable feed, or enable browser notifications for local news alerts.
Discussion
Discussion loads here through GitHub-backed comments when JavaScript is available.