Security Architecture
Active Engineering Focus
- API route hardening is an active release-management concern.
- See API Surface Hardening Audit for the current engineering checklist and
planning/API_SURFACE_HARDENING_AUDIT_2026-04-03.md for the remediation plan.
Authentication
- Provider: Clerk
- Methods: Email, Google, Microsoft, SSO (Enterprise)
- MFA: Supported for all accounts
- Sessions: JWT with refresh tokens
Authorization
- Organization-based access control
- Role-based permissions (Owner, Admin, Member)
- God Mode for platform admins
- Super Admin for billing/enterprise access
Data Protection
Encryption
| Data Type | At Rest | In Transit |
|---|
| Database | AES-256 (Neon) | TLS 1.3 |
| API Keys | AES-256 | TLS 1.3 |
| Passwords | Argon2 (Clerk) | TLS 1.3 |
| Files | R2 encryption | TLS 1.3 |
Sensitive Data Handling
- API keys encrypted in database
- OAuth tokens encrypted
- PII access logged
- GDPR compliance for EU users
Access Control
God Mode Access
// Requires explicit God Mode grant
await requireGodMode()
// Audit logged automatically
API Security
- Rate limiting per user/org
- CORS restricted to allowed origins
- CSRF protection via SameSite cookies
- Input validation via Zod
Incident Response
Severity Levels
| Level | Description | Response Time |
|---|
| P0 | System down, data breach | Immediate |
| P1 | Major feature broken | < 1 hour |
| P2 | Feature degraded | < 4 hours |
| P3 | Minor issue | < 24 hours |
Response Steps
- Detect: Via Sentry, monitoring, user report
- Contain: Disable affected feature if needed
- Investigate: Review logs, identify root cause
- Fix: Deploy hotfix or rollback
- Communicate: Notify affected users
- Document: Post-mortem within 48 hours
Data Breach Protocol
- Immediately notify security team
- Assess scope of breach
- Contain and remediate
- Legal notification (if required)
- User notification (within 72 hours for GDPR)
- Post-incident review
Compliance
GDPR
- Data export on request
- Right to deletion
- Privacy policy compliance
- DPA for enterprise
SOC 2 (Planned)
- Security policies documented
- Access controls audited
- Encryption verified
- Logging maintained
Security Contacts