Legal
Trust & Compliance.
What Aspect Services supplies, what you configure, and how Total CMS behaves under security and procurement review.
Who You’re Contracting With
Total CMS is developed and maintained by Aspect Services, LLC, a limited liability company incorporated in the State of California, United States, in 2008. Aspect Services owns and operates Total CMS, BetterSiteHost, and Weaver’s Space. All licenses and agreements are with Aspect Services, LLC.
- 18 years of continuous operation
- Over 4,438 Total CMS licenses deployed worldwide
What We Supply, and What You Configure
Total CMS is software. We are responsible for the application, its security model, and its ongoing maintenance. We are not responsible for how a given site is implemented, configured, or architected.
That boundary matters in practice. Content governance, access permissions, form handling, backup schedules and destinations, and any integration with external services are configuration decisions made by the implementer. Where an end client carries specific regulatory obligations, those are satisfied through implementation choices and the implementer’s own agreements with their client.
This is a standard shared-responsibility model: we supply a secure platform, you configure it appropriately for the deployment.
Application Security
Threat | Control |
|---|---|
SQL injection | Not applicable — flat-file architecture, no SQL database |
Cross-site scripting | Automatic HTML sanitization on all stored content |
Malicious SVG upload | SVG sanitization strips scripts and event handlers on upload |
Cross-site request forgery | Token validation on all forms |
Session hijacking | Session ID regeneration on login and impersonation, plus periodic rotation |
Malicious file upload | Type, size, extension, and MIME validation |
Credential attacks | Password hashing via PHP’s default algorithm (currently bcrypt) |
Clickjacking | frame-ancestors directive and X-Frame-Options on admin routes, active by default |
Encryption. Passwords — including CMS user accounts and file protection passwords — are hashed using PHP’s default password algorithm (currently bcrypt) and are never stored or transmitted in plaintext. Field-level encrypt() / decrypt() filters are available where a deployment requires encryption of specific content at rest.
Security testing. Total CMS is subject to regular automated application security testing using a third-party penetration testing platform, performing OWASP Top 10-aligned vulnerability scanning against the application. Findings are triaged and remediated as part of the development cycle.
This is automated testing rather than a manual engagement by an accredited assessment firm. A manual third-party penetration test can be arranged at customer cost where an enterprise deployment requires one.
Error monitoring. Total CMS reports application errors to a monitoring service operated by Aspect Services, LLC. This supports early detection and remediation of defects, including security-relevant ones. Reports contain the exception, stack trace, and request URL and method. No content, credentials, or request bodies are transmitted — request body capture is explicitly disabled, as is collection of cookies, session data, and client IP addresses.
Error monitoring is presented as a choice during initial setup and is enabled by default. It can be turned off at that point, or at any time afterwards, from the deployment’s settings — a single toggle in the admin interface, requiring no configuration file changes.
Vulnerability disclosure. Security issues can be reported to [email protected].
Confirmed vulnerabilities are addressed on the following targets:
Severity | Definition | Target |
|---|---|---|
Critical | Actively exploitable — unauthenticated remote code execution, authentication bypass | Patched and released within 72 hours of confirmation |
High | Significant impact requiring specific conditions or authenticated access | Within 10 business days |
Moderate / Low | Limited impact or requiring unusual preconditions | Next scheduled release |
All licensed customers are notified on release of a security update. Enterprise customers receive advance notice ahead of publication.
Access Control & Authentication
Administrative access. Access Groups (Standard edition and above) provide granular per-method permissions — GET, POST, PUT, DELETE — applied at collection, schema, template, settings, and utility level. Access can be scoped to individual collections and individual objects. Public versus authenticated access is configurable per collection.
Multi-factor authentication. Total CMS supports passkeys (WebAuthn/FIDO2) for administrative authentication. A passkey is a device-bound private key unlocked by biometric or device PIN — a phishing-resistant multi-factor credential recognized by NIST and CISA as a stronger authentication method than one-time-password schemes such as TOTP or SMS.
Passkeys are currently offered as an authentication option alongside passwords. Deployment-level enforcement that disables password fallback entirely is on the roadmap.
API access. The REST API uses token-based API key authentication via header or query parameter, with rate limiting, CORS controls, and per-key scoping. Session-based same-origin access requires CSRF token validation.
Single sign-on. Total CMS does not currently support SAML 2.0, LDAP, or Active Directory. These can be built as a custom extension for an enterprise deployment, quoted separately. Identity provider coordination on the client side is typically the schedule-limiting factor.
Audit logging. Total CMS provides error and system logging via the Log Analyzer, plus an event system that fires on content create, update, and delete operations, which can be hooked for custom logging.
Your Data, and Your Ability to Leave
Total CMS stores content as flat-file JSON and standard media files on your own server. There is no database, no proprietary format, and no encrypted content store that requires our software to read.
Export. The entire data directory can be downloaded at any time. JumpStart provides structured export of collections, schemas, and settings. There is no lock-in and no export fee.
What the application stores. CMS user accounts (name, email, hashed password), content you create, form submissions where public forms are configured, and standard web server access logs. We have no access to your content or your data. Application errors are reported to us as diagnostic telemetry unless disabled — see Error monitoring above.
Business Continuity
This is where flat-file architecture earns its keep.
If Aspect Services, LLC ceased operations, existing Total CMS deployments continue running indefinitely. You hold the code and you hold the data, in an open format, on infrastructure you control. There is no hosted service to shut off, no license server that must stay reachable for a site to serve pages, and no data extraction process to negotiate.
Source availability. The Total CMS source is publicly available and is present in every deployment. There is no compiled binary, no obfuscated code, and nothing held back that would require a third-party arrangement to release. This makes source code escrow unnecessary — the concern escrow exists to address does not arise here.
It also means the security claims on this page are auditable. A prospective client’s own security team can review how authentication, sanitization, and file handling are implemented rather than taking our description of them on trust.
Air-Gapped & Network-Isolated Deployments
Total CMS can run on networks with no outbound internet connectivity. Offline licensing is available as part of enterprise licensing.
How it works. We generate an offline license file on request, which is installed with the deployment. With the offline license in place, license validation is satisfied locally before any network call is attempted, and error monitoring is disabled outright. No validation callback, no periodic check-in, and no outbound connectivity occurs.
Updates and patches. Update packages are downloaded separately and transferred across the network boundary using whatever process the environment permits, then installed manually. The remediation targets published above govern when a patch is released; transfer and installation timing is determined by the client’s own change control process.
What continues to work. All standard Total CMS functionality operates unchanged. Content storage, image processing, templating, and both the public site and the admin interface run locally against the filesystem. With the offline license installed, no feature attempts an external connection.
Error monitoring is disabled in isolated deployments. It is not required for any functionality.
What requires internal provision. Integrations that the implementer configures to reach outside the deployment — SMTP mail delivery, webhooks, and any external API consumption — depend on services being reachable from within the isolated network. Routing these to internal equivalents, or accepting that they are unavailable, is a deployment decision for the implementer.
This deployment model suits environments with network segmentation, data sovereignty, or classification requirements that preclude vendor connectivity. Contact us to discuss offline licensing for a specific deployment.
Licensing & Intellectual Property
Multi-site deployments. Total CMS is licensed per site. Enterprise multi-site deployments are quoted per project on a volume curve rather than at list price, billed as an annual or monthly subscription. Billing commences per site at go-live — publicly accessible with the production domain pointed — not on a planned deployment schedule.
License term and continuity. Subscription licenses carry a minimum term of 24 months. Following that term, the license confers a perpetual right to continue operating the version current at the point the subscription ends, and that version advances with each further period of continuous subscription. Updates and support require an active subscription.
This mirrors one-time purchases, which include two years of updates and a perpetual right to run the software. Both paths provide the same entitlement; they differ only in payment structure.
License state never affects your live site. Serving pages is never gated by license validation — no lapse, expiry, billing issue, or outage of our infrastructure can take a live site offline or affect what visitors see. License validation applies to content editing, package installation, and updates: where a license is invalid, the deployment continues serving publicly in full while administrative write access directs to license management until resolved. For environments where even that is unacceptable, see Air-Gapped & Network-Isolated Deployments above — the offline license removes the validation dependency entirely.
Ownership. The client owns all content, media, and site-specific configuration outright. Aspect Services, LLC retains ownership of the Total CMS platform and general-purpose platform features. Custom extensions developed for a specific deployment are scoped and assigned in the applicable statement of work.
Hosting
Total CMS runs anywhere. It requires PHP 8.2+ and nothing else — no database server, no specific control panel, no vendor infrastructure. Deploy it on your own servers, your client’s servers, or any host you already use.
For clients who prefer managed infrastructure, we offer enterprise hosting through BetterSiteHost, also operated by Aspect Services, LLC. That is where uptime commitments, backup and disaster recovery, sub-processors, and data residency are documented.
BetterSiteHost Trust & Compliance →
Contact
Questions about this document can be sent to .
Aspect Services, LLC — California, United States