Security & Data Protection

# Security & Data Protection ## Infrastructure Security ### Data Encryption - All data is encrypted at rest and in transit. - Database connections use TLS/SSL encryption. - File storage uses server-side encryption. ### Authentication - Passwords are hashed using industry-standard algorithms. - Session tokens have configurable expiration. - Password reset flows use secure, time-limited tokens. ### Row-Level Security (RLS) HireBee uses Supabase's Row-Level Security to ensure data isolation: - Each organization's data is accessible only to its members. - RLS policies are enforced at the database level — not just the application layer. - Even if application code has a bug, database policies prevent unauthorized access. ## Access Control ### Role-Based Permissions - Seven distinct roles with granular permissions. - Roles are enforced server-side using security-definer functions. - Role changes are logged in the audit trail. ### Session Management - View all active sessions from your profile. - Revoke sessions remotely if a device is lost or compromised. - Sessions track IP address, browser, and device information. ### API Security - API keys have scoped permissions. - Keys can be revoked instantly. - API usage is logged and rate-limited. ## Compliance ### GDPR - Full consent tracking and management. - Data export and deletion capabilities. - Configurable data retention policies. - Audit trail for all data access and modifications. ### Audit Logging All security-relevant actions are logged: - User login/logout events. - Data access and modifications. - Role changes and permission updates. - API key creation and usage. ## Best Practices for Users 1. Use strong, unique passwords. 2. Don't share your login credentials. 3. Review active sessions periodically. 4. Revoke API keys you no longer use. 5. Keep your team members' roles up to date. 6. Configure data retention policies.