Secret Encryption
All secret values are encrypted using AES-256-GCM — an authenticated encryption algorithm that provides both confidentiality and integrity. This is the same standard used by financial institutions and government agencies.
Key Principles
Encryption at rest — Secret values are encrypted before being stored in the database
SE isolation — SEs who create customer-managed secrets cannot see the customer's actual values
Customer isolation — Each customer's secrets are scoped to their account
Organization isolation — All resources are scoped to your organization — no cross-tenant access
API key hashing — Bridge API keys are stored as bcrypt hashes, not plaintext
Authentication Security
SE dashboard — JWT-based authentication with bcrypt password hashing
Customer portal — Magic link authentication with 15-minute token expiration
API keys — Generated with cryptographic randomness, shown only once at creation
Webhook tokens — Unique per bridge, included in URL for authentication
Input Validation
All API inputs are validated using Zod schemas at the API boundary. This prevents injection attacks, malformed data, and unauthorized field access.
Authorization
Every API request checks that the authenticated user belongs to the same organization as the requested resource. Role-based access control (RBAC) restricts actions based on user role (Admin, SE, Viewer).