Security and Compliance

Security Foundations

• Mandatory email verification before API token issuance.
• Session auth for web and bearer auth for API clients.
• Capability checks for workspace-scoped reads and writes.
• Correlation IDs for request traceability and operational forensics.

Audit and Traceability

Financial, auth, and integration-relevant actions are recorded in audit and event tables so teams can trace who did what, where, and when.

• AuditLog captures action, actor, workspace, and metadata.
• WebhookEvent stores signature outcome and raw payload for review.
• IdempotencyKey records mutation replays and conflict detection.

SOC2-Ready Direction

• Least privilege default with explicit capability checks.
• Immutable or append-friendly security event history.
• Sensitive data minimization in logs and request metadata.
• Repeatable controls documented in runbooks and ADRs.

Next Hardening Steps

• Per-endpoint sensitivity-based rate limits.
• OAuth2 third-party flows and scoped client management.
• Automated security scenarios (IDOR, mass assignment, replay attacks).
• Alerting tied to API error rate, latency, and integration failure thresholds.