We take the security of your business data seriously. Here's how we protect your information and your customers' information.
Data in transit is protected by TLS 1.2+. Application databases and object storage use provider-managed encryption at rest. OAuth tokens for third-party integrations (Google, Outlook, QuickBooks) are encrypted with AES-256-GCM when TOKEN encryption is configured in the deployment environment.
PostgreSQL databases are hosted on isolated, private networks with no public internet exposure. Automated backups are taken daily with 30-day retention. All queries are parameterized to prevent SQL injection.
OblyssPro runs on Railway (production) and dedicated Mac Mini infrastructure (staging). Production deployments are automated via CI/CD with zero-downtime rolling deploys. All infrastructure access requires SSH key authentication.
Role-based access control (RBAC) with Owner, Admin, and Member tiers. Business-wide two-factor authentication (TOTP) can be enforced by account owners. All cross-tenant access is prevented at the database query level via mandatory businessId scoping.
Passwords are hashed with bcrypt (cost factor 12). Session tokens are signed JWTs with configurable expiry. Two-factor authentication uses TOTP with backup codes. All API endpoints require authentication via NextAuth session validation.
Every database model includes a businessId field with database-level indexing. API routes enforce tenant isolation as the first operation. Cross-tenant resource access returns 404 (not 403) to prevent information disclosure.
Twilio inbound webhook signatures are validated with the Twilio auth token. Stripe webhook signatures are verified on every event. OAuth token exchanges use PKCE where supported. Integration tokens are encrypted at rest when encryption is configured.
Electronic signatures capture consent timestamp, signer IP address, and user agent. Signed contract PDFs and signature images are stored in encrypted cloud storage (Cloudflare R2) with access-controlled retrieval.
If you discover a security vulnerability, please report it responsibly by emailing security@oblysspro.com. We will acknowledge your report within 48 hours and work with you to address the issue.