Security Overview
NearSync enforces security at multiple layers, from the network edge to individual database rows. This page summarizes the security architecture and threat model. Detailed documentation for each layer is linked below.
Defense-in-Depth Layers
Security is enforced at six layers, each operating independently so that a failure in one layer does not compromise the others:
1. Network Layer
CORS policies restrict which origins can call backend APIs. Rate limiting protects against abuse on a per-IP, per-endpoint basis. All traffic is encrypted with TLS 1.2+.
See API Security for details.
2. Authentication Layer
All non-public API endpoints require a valid JWT. Sessions are managed via Supabase Auth with configurable expiry. Multi-factor authentication (TOTP) is supported and can be required per-organization. Cross-domain sessions use chunked HTTP cookies for seamless navigation between NearSync subdomains.
See Authentication for details.
3. Authorization Layer
Role-based access control (RBAC) defines what each user can see and do. System roles provide granular access, from Admin - the highest role with platform access - down to read-only viewer. Permissions are checked both client-side (navigation gating, component visibility) and server-side (RLS policies).
See RBAC & Permissions for details.
4. Data Layer
PostgreSQL Row-Level Security (RLS) policies enforce data isolation at the database level. In the managed multi-tenant model, RESTRICTIVE org_id policies ensure that no query can access data belonging to another organization - regardless of application logic. In the BYOK model, each client has a fully isolated database.
See Row-Level Security for details.
5. Application Layer
Input validation, parameterized queries (preventing SQL injection), HTML escaping in email templates (preventing XSS), and API key isolation protect against application-level attacks.
See API Security for application-layer details.
6. Infrastructure Layer
NearSync runs on infrastructure provided by vendors with SOC 2 Type II certification:
- Supabase - database, authentication, edge functions, file storage
- Vercel - frontend hosting, CDN, SSL termination, DDoS mitigation
Both platforms provide automatic security patches, encrypted secrets storage, and network-level protections.
Threat Model Summary
| Threat | Mitigation |
|---|---|
| Cross-tenant data access | RESTRICTIVE RLS policies on all tenant tables; org_id isolation verified by automated test suite |
| Unauthorized API access | JWT validation on all non-public endpoints; expired/invalid tokens rejected |
| Privilege escalation | RBAC with server-side enforcement via RLS; no client-side-only permission checks for data access |
| SQL injection | Parameterized queries via Supabase client library; no raw SQL in application code |
| XSS | HTML escaping in email templates; React's built-in XSS protection for rendered content |
| API abuse | Per-IP, per-endpoint rate limiting with configurable thresholds |
| Credential theft | API keys stored server-side (database or edge function secrets); MFA available for user accounts |
| Data exfiltration (BYOK) | Zero persistent database access post-provisioning; Sentinel returns metadata only |
Data Classification
NearSync handles several categories of data, each with appropriate access controls:
| Category | Examples | Protection |
|---|---|---|
| PII | User emails, names, phone numbers | RLS-restricted to organization; cross-org isolation enforced |
| Financial | Invoice amounts, payment records, expenses | RLS-restricted; payment processing delegated to certified providers |
| Communications | Chat messages, WhatsApp messages, emails | RLS-restricted to organization |
| Documents | Contracts, uploads, PDFs | RLS-restricted; signed URLs with expiry for storage access |
| Authentication | Passwords, sessions, MFA secrets | Managed by Supabase Auth; not accessible to application code |
| Configuration | System manifest, feature flags, API keys | RLS-restricted to organization; API keys encrypted at rest |
| Audit | Admin actions, workflow logs | Append-only; scoped to organization |
Monitoring and Incident Response
- Error tracking via Sentry across all three applications (admin dashboard, client portal, marketing website)
- Audit logging records admin actions with timestamps and actor identity
- Workflow audit logs record automation execution steps and outcomes
- Alerting configured for application error thresholds
Compliance
- GDPR-ready configuration with privacy URL, terms URL, DPA contact, and GDPR mode flags in the system manifest
- Data export available for managed clients within 30 days of request
- BYOK clients own all data and manage compliance independently
- Standard Data Processing Agreement available for enterprise managed deployments
Security Audit History
NearSync has completed a comprehensive security audit covering 12 areas:
- JWT authentication middleware on all API endpoints
- CORS locked to production domains (no wildcards)
- AI API keys removed from client-side bundles
- Authorization headers on all authenticated requests
- RLS enabled on all tables (including 7 that were previously unprotected)
- Hardcoded admin references replaced with role-based checks
- Schema validation and audit
- API key fallback paths removed
- HTML escaping in email templates
- Per-endpoint rate limiting
- Dependency audit across all packages
- Debug logging removed from production builds
Test coverage: 588+ tests with 100% pass rate, including 15-table tenant isolation verification.
Section Contents
- Authentication - JWT, MFA, sessions, cross-domain auth
- RBAC & Permissions - roles, permissions, module gating
- Row-Level Security - database-level data isolation
- API Security - CORS, rate limiting, input validation