Skip to main content

Security Overview

NearSync enforces security at multiple layers, from the network edge to individual database rows. This page summarizes the security architecture and threat model. Detailed documentation for each layer is linked below.

Defense-in-Depth Layers

Security is enforced at six layers, each operating independently so that a failure in one layer does not compromise the others:

1. Network Layer

CORS policies restrict which origins can call backend APIs. Rate limiting protects against abuse on a per-IP, per-endpoint basis. All traffic is encrypted with TLS 1.2+.

See API Security for details.

2. Authentication Layer

All non-public API endpoints require a valid JWT. Sessions are managed via Supabase Auth with configurable expiry. Multi-factor authentication (TOTP) is supported and can be required per-organization. Cross-domain sessions use chunked HTTP cookies for seamless navigation between NearSync subdomains.

See Authentication for details.

3. Authorization Layer

Role-based access control (RBAC) defines what each user can see and do. System roles provide granular access, from Admin - the highest role with platform access - down to read-only viewer. Permissions are checked both client-side (navigation gating, component visibility) and server-side (RLS policies).

See RBAC & Permissions for details.

4. Data Layer

PostgreSQL Row-Level Security (RLS) policies enforce data isolation at the database level. In the managed multi-tenant model, RESTRICTIVE org_id policies ensure that no query can access data belonging to another organization - regardless of application logic. In the BYOK model, each client has a fully isolated database.

See Row-Level Security for details.

5. Application Layer

Input validation, parameterized queries (preventing SQL injection), HTML escaping in email templates (preventing XSS), and API key isolation protect against application-level attacks.

See API Security for application-layer details.

6. Infrastructure Layer

NearSync runs on infrastructure provided by vendors with SOC 2 Type II certification:

  • Supabase - database, authentication, edge functions, file storage
  • Vercel - frontend hosting, CDN, SSL termination, DDoS mitigation

Both platforms provide automatic security patches, encrypted secrets storage, and network-level protections.

Threat Model Summary

ThreatMitigation
Cross-tenant data accessRESTRICTIVE RLS policies on all tenant tables; org_id isolation verified by automated test suite
Unauthorized API accessJWT validation on all non-public endpoints; expired/invalid tokens rejected
Privilege escalationRBAC with server-side enforcement via RLS; no client-side-only permission checks for data access
SQL injectionParameterized queries via Supabase client library; no raw SQL in application code
XSSHTML escaping in email templates; React's built-in XSS protection for rendered content
API abusePer-IP, per-endpoint rate limiting with configurable thresholds
Credential theftAPI keys stored server-side (database or edge function secrets); MFA available for user accounts
Data exfiltration (BYOK)Zero persistent database access post-provisioning; Sentinel returns metadata only

Data Classification

NearSync handles several categories of data, each with appropriate access controls:

CategoryExamplesProtection
PIIUser emails, names, phone numbersRLS-restricted to organization; cross-org isolation enforced
FinancialInvoice amounts, payment records, expensesRLS-restricted; payment processing delegated to certified providers
CommunicationsChat messages, WhatsApp messages, emailsRLS-restricted to organization
DocumentsContracts, uploads, PDFsRLS-restricted; signed URLs with expiry for storage access
AuthenticationPasswords, sessions, MFA secretsManaged by Supabase Auth; not accessible to application code
ConfigurationSystem manifest, feature flags, API keysRLS-restricted to organization; API keys encrypted at rest
AuditAdmin actions, workflow logsAppend-only; scoped to organization

Monitoring and Incident Response

  • Error tracking via Sentry across all three applications (admin dashboard, client portal, marketing website)
  • Audit logging records admin actions with timestamps and actor identity
  • Workflow audit logs record automation execution steps and outcomes
  • Alerting configured for application error thresholds

Compliance

  • GDPR-ready configuration with privacy URL, terms URL, DPA contact, and GDPR mode flags in the system manifest
  • Data export available for managed clients within 30 days of request
  • BYOK clients own all data and manage compliance independently
  • Standard Data Processing Agreement available for enterprise managed deployments

Security Audit History

NearSync has completed a comprehensive security audit covering 12 areas:

  • JWT authentication middleware on all API endpoints
  • CORS locked to production domains (no wildcards)
  • AI API keys removed from client-side bundles
  • Authorization headers on all authenticated requests
  • RLS enabled on all tables (including 7 that were previously unprotected)
  • Hardcoded admin references replaced with role-based checks
  • Schema validation and audit
  • API key fallback paths removed
  • HTML escaping in email templates
  • Per-endpoint rate limiting
  • Dependency audit across all packages
  • Debug logging removed from production builds

Test coverage: 588+ tests with 100% pass rate, including 15-table tenant isolation verification.

Section Contents