Skip to main content

​
Security-First Architecture

Switchbord is a multi-tenant WhatsApp operations platform that processes organizational client PII at scale. Security is not an afterthought — it is built into the architecture at every layer: from how workspace context is resolved on every API call, to how secrets are stored, to how PII is handled before reaching any AI model. An adversarial security audit was performed across ISO 27001, GDPR, NIS2, HIPAA, and SOC 2 dimensions. The findings drove a structured remediation program (BORD-149 through BORD-176) that is actively ongoing.
This documentation reflects the state of security controls as of the current release. Items marked Planned are tracked in Linear and will be implemented in upcoming sprints.

​
Compliance Targets

ISO 27001

Information security management system controls. Annex A controls mapped across access control, cryptography, operations security, and supplier relationships.

GDPR

Full compliance with EU data protection regulation. Data subject rights (Art.15, 17, 20), lawful basis, DPA with sub-processors, privacy by design (Art.25).

NIS2

EU Network and Information Security Directive. Risk management measures (Art.21), incident reporting obligations (Art.23).

HIPAA-Ready

Technical safeguards aligned with HIPAA §164.312. Access controls, audit controls, integrity controls, and transmission security. Not a covered entity by default — consult your compliance officer.

SOC 2 Type II

Trust Service Criteria mapping across CC1–CC9. Logical access, change management, monitoring, and availability controls documented and partially implemented.

​
Architecture Pillars

​
Per-Workspace Isolation

Every tenant operates in a fully isolated workspace. Workspace context is resolved server-side from the authenticated user’s workspace_members record — never from environment variables or client-supplied headers. A user in workspace A cannot access, modify, or send messages on behalf of workspace B. See Multi-Tenancy & Workspace Isolation.

​
Supabase Vault for Secrets

Tenant secrets — Meta access tokens, webhook signing secrets, LLM API keys — are stored in Supabase Vault, scoped per-workspace. No secrets live in public schema tables. Environment variable fallbacks are gated to non-production environments only. See Secrets Management & Encryption.

​
Role-Based Access Control

Four roles are enforced at every API route: owner, admin, developer, and operator. Role checks are performed after workspace context resolution, before any business logic executes. See Authentication & Access Control.

​
GDPR Data Rights

Contacts have a right to access their data (Art.15/20) and a right to erasure (Art.17). Both are implemented as API endpoints that export or anonymize PII in-place, with audit log entries on every operation. See Data Protection & GDPR.

​
PII Pseudonymization for AI

Before any contact data reaches an AI model, the PII redactor replaces phone numbers, emails, and (optionally) names with reversible tokens. Tokens are restored in the LLM response before saving. Disabling pseudonymization is only permitted when a self-hosted AI provider is configured. See Data Protection & GDPR.

​
Implementation Status

​
Detailed Documentation

Multi-Tenancy

Workspace isolation model, context resolution, and message dispatch isolation.

Authentication

Session management, RBAC, API keys, password policy, and MFA.

Data Protection & GDPR

PII handling, data subject rights, pseudonymization, and sub-processors.

Secrets & Encryption

Supabase Vault, security headers, TLS, and encryption at rest.

Audit Logging

Audit trail, observability, and planned breach notification.

Compliance Matrix

Full control mapping across ISO 27001, GDPR, NIS2, HIPAA, and SOC 2.