Security

Protection close to the data

The controls below describe implemented behavior without certification, availability, or delivery claims.

Credentials

Passwords are hashed with Argon2id. Password values are never stored in plaintext or written to audit metadata.

Short-lived signed access tokens are paired with database-backed sessions and rotated opaque refresh tokens. Refresh-token reuse revokes the session.

Sensitive API requests verify the active session against PostgreSQL. Administrator routes also re-check the current database role on every request.

Mutations require the expected origin, validate bounded JSON with Zod, use database rate limits, and return RFC 7807 problem responses.

Caddy terminates HTTPS and WSS. PostgreSQL and Redis have no published host ports and communicate only on the internal container network.

Security and administrative events are audited. Support message text and requester email are deliberately excluded from audit metadata.

Security

The controls below describe implemented behavior without certification, availability, or delivery claims.

Passwords are hashed with Argon2id. Password values are never stored in plaintext or written to audit metadata.

Short-lived signed access tokens are paired with database-backed sessions and rotated opaque refresh tokens. Refresh-token reuse revokes the session.

Sensitive API requests verify the active session against PostgreSQL. Administrator routes also re-check the current database role on every request.

Mutations require the expected origin, validate bounded JSON with Zod, use database rate limits, and return RFC 7807 problem responses.

Caddy terminates HTTPS and WSS. PostgreSQL and Redis have no published host ports and communicate only on the internal container network.

Security and administrative events are audited. Support message text and requester email are deliberately excluded from audit metadata.