Security

What this page represents

This page describes controls present in the Truvyx repository and the boundaries visible in the deployed product. A product feature is not, by itself, an audit, certification, legal conclusion, recovery exercise, or guarantee about a hosting provider.

Implemented controls

• Transport and browser policy

  Production responses set HSTS, Content Security Policy, clickjacking, MIME-sniffing, referrer, and browser permissions headers. Hosted deployments terminate HTTPS at the platform edge.

  Control source: apps/web/next.config.ts

• Passwords, API keys, and integration credentials

  Passwords use bcrypt with cost 12. API keys are stored as SHA-256 hashes and their raw value is returned only when created. Stored provider credentials use AES-256-GCM with authenticated organization and credential context; a legacy CBC reader exists only to migrate older ciphertext.

  Control source: apps/web/src/auth.ts; apps/web/src/lib/crypto.ts

• Authentication abuse controls

  Redis-backed sliding windows limit authentication, recovery, verification, invitation, and selected public routes by IP and identity. Repeated invalid passwords add escalating one-minute, five-minute, fifteen-minute, and one-hour credential lockouts. A rate-limit storage failure fails closed with a temporary-unavailable response or denied sign-in.

  Control source: apps/web/src/lib/rate-limit.ts; apps/web/src/lib/credential-lockout.ts

• Identity linking

  OAuth identities already linked to an account may sign in. An OAuth email collision with an existing account is rejected and recorded instead of silently linking providers by email.

  Control source: apps/web/src/lib/oauth-account-linking.ts

• Organization permissions

  VIEWER has read-only access. MEMBER receives workspace mutation permissions. ADMIN adds organization management. OWNER additionally receives organization deletion. API routes enforce these permissions on the server; navigation state is only a user-interface reflection.

  Control source: apps/web/src/lib/authorization.ts

• Tenant scoping

  Session and API-key guards resolve one organization, and resource queries include that organization identifier. This is application-layer tenant isolation. The repository does not claim PostgreSQL row-level security, and new query paths still require review and tests for organization predicates.

  Control source: apps/web/src/auth.ts; apps/web/src/lib/registry/api-key-auth.ts; apps/web/src/lib/authorization.ts

• Input validation and errors

  API routes define request-specific validation, commonly with Zod, and reject malformed JSON. Response codes follow each endpoint contract, so callers must handle both 400-series validation responses and documented service errors; the platform does not promise that every validation failure is a 422.

  Control source: apps/web/src/app/api

• Audit evidence and signatures

  Compliance audit records distinguish unsigned, signed, verified, and invalid states. RS256 signatures cover recursively canonicalized JSON, retain public-key history across rotation, and make later record changes detectable. Ordinary product activity is not represented as a universal compliance audit log.

  Control source: apps/web/src/lib/audit-signing.ts; apps/web/src/app/api/compliance

• Trace privacy and exports

  Raw traces are size-limited and encrypted with AES-GCM. PRIVATE, ORGANIZATION, and FAULT_ATLAS visibility is enforced at ingestion and disclosure. Organization exports use a versioned manifest, discover organization-owned records, and omit declared secret-bearing fields.

  Control source: apps/web/src/lib/trace-privacy.ts; apps/web/src/app/api/exports

• Dependency checks

  Pull requests and pushes to the main branch install the locked dependency graph and fail when pnpm reports a high or critical production dependency advisory. GitHub Actions records the result; this does not describe deployments made outside that workflow.

  Control source: .github/workflows/security-controls.yml

• Optional analytics

  Google Analytics and Meta Pixel remain unloaded until a visitor explicitly accepts optional analytics. The choice is stored locally, can be reopened, and Global Privacy Control forces the declined state.

  Control source: apps/web/src/components/analytics-consent.tsx

Hosting and data location

The hosted application uses managed application and database infrastructure. Customer-managed connections can point evaluation traffic at a validated customer origin. The actual processing location, backup window, and provider retention depend on the active deployment and provider configuration. A region label or an on-premise URL is not a sovereignty certification.

Assurance boundaries

Truvyx does not currently claim its own SOC 2 certification, a completed independent penetration test, a tested recovery-time objective, a tested recovery-point objective, or a universal fixed log-retention period. Provider attestations apply to the provider's control environment and do not automatically certify Truvyx. Product controls can support a customer's compliance work but do not establish compliance with a particular law or framework.

Responsible disclosure

Report suspected vulnerabilities to security@truvyx.org. Include the affected route or feature, reproduction steps, and likely impact. Test only accounts and data you own or have permission to use; avoid denial-of-service testing and public disclosure while the report is being investigated.

Contact

Security: security@truvyx.org
Privacy and legal: legal@truvyx.org
Support: support@truvyx.org