Security & Compliance
Security architecture
Defence in depth across five concentric rings:
- Transport — TLS-only, HSTS preload,
upgrade-insecure-requests.
- Browser — strict CSP (
frame-ancestors 'none', connect-src scoped to *.supabase.co + self), X-Content-Type-Options: nosniff, minimal Permissions-Policy, Referrer-Policy: strict-origin-when-cross-origin.
- Identity — TOTP MFA mandatory (AAL2 gate on
/app/*), brute-force lockout, 30-min idle sign-out, 8-hour absolute session maximum.
- Application — Zod input validation in server functions, server-only modules blocked from client bundles, role checks via
SECURITY DEFINER function.
- Data — RLS on every public table, field-level encryption for sensitive payloads, append-only audit trails, service-role bypass restricted to trusted server code.
Headers are applied in:
public/_headers (production CDN)vite.config.ts (dev server)src/server.ts (SSR responses)
Encryption standards
| Concern | Mechanism |
|---|
| Data in transit (browser ↔ edge) | TLS 1.3 via Cloudflare; HSTS max-age=63072000; includeSubDomains; preload. |
| Data in transit (edge ↔ Supabase) | TLS 1.3, mutual auth via JWT. |
| Data at rest (Postgres) | Provider-managed AES-256 encryption. |
| Field-level encryption | src/lib/security/fieldEncryption.ts for sensitive payloads at the application boundary. |
| Secrets | Lovable Cloud secret store, never committed to git, never exposed to the browser bundle. |
Audit logging
All security-relevant events are recorded:
| Event class | Table | Writer |
|---|
| Sign-in attempts (success + failure) | public.sec_login_attempts | login-rate-limit edge function |
| Role grants, revokes, attestations | public.access_audit_log | Server functions |
| MFA enrolment | public.access_audit_log | Server functions |
| GDPR DSARs | public.gdpr_requests | Server functions |
Logs are append-only from the application's perspective. Only the service role can write (and only the documented writers do).
Access controls
- RLS enabled on every
public table.
GRANT statements explicit in every migration that creates a public-schema table.- Role checks via
public.has_role(uuid, app_role) (SECURITY DEFINER, fixed search_path = public).
- Route gating: TanStack Start
beforeLoad on _authenticated/ subtree.
- Server function gating:
requireSupabaseAuth middleware on every protected fn.
Data protection controls
| Control | Implementation |
|---|
| Least-privilege role assignment | Time-bound access_grants with expires_at |
| Periodic access review | access_reviews workflow + attestation evidence |
| Data subject rights (GDPR) | gdpr_requests workflow + DPO assignment |
| Tenant isolation | RLS scoping via useTenant context and tenant-keyed FKs |
| LLM I/O guardrails | src/lib/security/llmGuard.ts filters input and output of AI-mediated surfaces |
| Resilience to upstream failure | src/lib/resilience/circuitBreaker.ts |
Regulatory mapping
DORA (Digital Operational Resilience Act)
| Article | Control | Where implemented |
|---|
| Art. 9 — ICT security | Strong authentication, access attempt logging | auth.tsx, login-rate-limit, sec_login_attempts |
| Art. 11 — Response & recovery | Circuit breakers, idle sign-out | circuitBreaker.ts, InactivityGuard |
| Art. 12 — Record keeping | Append-only audit trails | access_audit_log, audit log viewer |
ISO/IEC 27001:2022 (Annex A)
| Control | Implementation |
|---|
| A.5.15 Access control | RBAC + RLS + has_role |
| A.5.34 Privacy / PII | DSAR workflow |
| A.8.5 Secure authentication | TOTP MFA, brute-force lockout |
| A.8.24 Cryptography | TLS, field-level encryption |
| A.8.28 Secure coding | Zod validation, server/client boundary enforcement |
NIST AI RMF
| Function | Implementation |
|---|
| GOVERN | Access governance pages, role attestation reviews |
| MAP | /app/ai-assessments, /app/ai-models |
| MEASURE | /app/fairness, monitoring dashboards |
| MANAGE | /app/ai-approvals, /app/exception-center |
OWASP Top 10
| Risk | Mitigation |
|---|
| A01 Broken Access Control | RLS + has_role + AAL2 route gate |
| A02 Cryptographic Failures | HTTPS-only via HSTS, field-level encryption |
| A05 Security Misconfiguration | CSP, headers, frame-ancestors none |
| A07 Identification & Authentication Failures | MFA, rate limit, idle timeout |
| A09 Security Logging | Append-only audit log + viewer |
NCSC Cloud Security Principles
- CSP 9 (Secure user management) — MFA enforcement, login attempt logging, audit access reviews.
For the full text of how each control is implemented, see SECURITY.md at the repository root.