Perimeter defense at the network edge. Absorbing volumetric and protocol-level attacks before they reach application infrastructure.
✦ Security & trust ✦
A 13-layer architecture, reported honestly.
We publish what each layer of our security architecture is supposed to do, exactly how we test it, and the real, current status of that testing, including the layers we haven't finished yet. A status never shows “tested and passing” until a real test has actually run.
13 Tested & passing
TLS everywhere, with HSTS to prevent protocol downgrade, so no request or response travels in the clear.
Application-layer filtering and per-route rate limits on authentication, PIN verification, and public unauthenticated forms.
Credentials + JWT session strategy with server-side revocation (tokenVersion), a hard absolute session ceiling independent of activity, and a PIN quick-resume path that can only unlock an already-valid session, never cold-start one.
Role-based access control enforced independently at both the page layer (lib/auth/rbac.ts) and the API layer (lib/auth/api-guard.ts), plus data-level tenant isolation beyond simple role checks.
Zod schema validation at every mutation boundary, backed structurally by Prisma's parameterized query builder, no raw SQL string interpolation in any request-handling code path.
NextAuth's built-in CSRF token requirement on state-changing requests, SameSite session cookies, and React's default output escaping against stored/reflected XSS.
AES-256-GCM encryption of sensitive guest contact fields (email, phone) applied at the repository layer, never as Prisma middleware, so plaintext never reaches the database.
Least-privilege database roles (application role scoped to only the schemas/operations it needs, distinct from an administrative superuser) plus encrypted backups with point-in-time recovery.
Environment-scoped secrets (encrypted at the hosting provider), never committed to source control, rotated on any suspected exposure.
Automated tracking of vulnerable or malicious dependencies, with scheduled scans independent of when a developer happens to run one manually.
An append-only record of every sensitive admin action (AdminAuditLog), plus logging of failed logins and PIN lockouts, as a foundation for anomaly detection.
COPPA protections for guest records, a provable legal-acceptance trail (LegalAcceptance versioned against LegalDocument), and a GDPR right-to-erasure flow with a cancellable grace period.
Found something we missed?
We welcome good-faith security research. Report anything through our support system rather than exploiting or publicly disclosing it first. See our Acceptable Use Policy for details.