Security

Portal vault secrets use per-item envelope encryption. Secret values and their data keys are encrypted with AES-256-GCM using independent random nonces. The key-encryption key is held in server-only deployment configuration and supports versioned rotation.

The service can decrypt an authorized secret to deliver it to an authorized user. This is therefore not a zero-knowledge system, and BNSN does not describe it as one.

Supabase Auth establishes the session. PostgreSQL Row-Level Security scopes protected business records to the signed-in client organization. Route guards improve navigation, but database policy is the tenant boundary.

Privileged operator actions require the admin role and a TOTP multi-factor session at authentication assurance level two. Service-role credentials remain in server-only modules.

Vault access is short-lived and audited. Reveal, copy, rotation, revocation, and other lifecycle actions produce append-only events. Masked characters in the interface are only presentation; encryption, authorization, and audit records provide the protection.

The application sends restrictive security headers, keeps private provider keys out of browser bundles, separates preview and production configuration, and verifies provider webhooks before applying billing or contract state.

No security system eliminates all risk. Clients should grant the minimum access needed, rotate credentials after personnel or provider changes, and report suspected unauthorized access promptly.

Send suspected security issues to [email protected] with a concise description and a safe way to reproduce the problem. Do not include passwords, private keys, payment card data, or live client secrets in the report.