> ## Documentation Index
> Fetch the complete documentation index at: https://docs.switchbord.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Security Overview
> Switchbord's security-first architecture for enterprise WhatsApp operations — ISO 27001, GDPR, NIS2, HIPAA-ready, and SOC 2 aligned.
## Security-First Architecture
Switchbord is a multi-tenant WhatsApp operations platform that processes organizational client PII at scale. Security is not an afterthought — it is built into the architecture at every layer: from how workspace context is resolved on every API call, to how secrets are stored, to how PII is handled before reaching any AI model.
An adversarial security audit was performed across ISO 27001, GDPR, NIS2, HIPAA, and SOC 2 dimensions. The findings drove a structured remediation program (BORD-149 through BORD-176) that is actively ongoing.
This documentation reflects the state of security controls as of the current release. Items marked **Planned** are tracked in Linear and will be implemented in upcoming sprints.
## Compliance Targets
Information security management system controls. Annex A controls mapped across access control, cryptography, operations security, and supplier relationships.
Full compliance with EU data protection regulation. Data subject rights (Art.15, 17, 20), lawful basis, DPA with sub-processors, privacy by design (Art.25).
EU Network and Information Security Directive. Risk management measures (Art.21), incident reporting obligations (Art.23).
Technical safeguards aligned with HIPAA §164.312. Access controls, audit controls, integrity controls, and transmission security. Not a covered entity by default — consult your compliance officer.
Trust Service Criteria mapping across CC1–CC9. Logical access, change management, monitoring, and availability controls documented and partially implemented.
## Architecture Pillars
### Per-Workspace Isolation
Every tenant operates in a fully isolated workspace. Workspace context is resolved server-side from the authenticated user's `workspace_members` record — never from environment variables or client-supplied headers. A user in workspace A cannot access, modify, or send messages on behalf of workspace B.
See [Multi-Tenancy & Workspace Isolation](/security/multi-tenancy).
### Supabase Vault for Secrets
Tenant secrets — Meta access tokens, webhook signing secrets, LLM API keys — are stored in Supabase Vault, scoped per-workspace. No secrets live in public schema tables. Environment variable fallbacks are gated to non-production environments only.
See [Secrets Management & Encryption](/security/secrets-and-encryption).
### Role-Based Access Control
Four roles are enforced at every API route: **owner**, **admin**, **developer**, and **operator**. Role checks are performed after workspace context resolution, before any business logic executes.
See [Authentication & Access Control](/security/authentication).
### GDPR Data Rights
Contacts have a right to access their data (Art.15/20) and a right to erasure (Art.17). Both are implemented as API endpoints that export or anonymize PII in-place, with audit log entries on every operation.
See [Data Protection & GDPR](/security/data-protection).
### PII Pseudonymization for AI
Before any contact data reaches an AI model, the PII redactor replaces phone numbers, emails, and (optionally) names with reversible tokens. Tokens are restored in the LLM response before saving. Disabling pseudonymization is only permitted when a self-hosted AI provider is configured.
See [Data Protection & GDPR](/security/data-protection).
## Implementation Status
| Control Area | Status | Details |
| -------------------------------- | ------------- | --------------------------------------------------------------------------------------------- |
| Multi-tenant isolation | ✅ Implemented | workspace\_members-based resolution, all routes threaded |
| Auth guard on all endpoints | ✅ Implemented | ai-assistant, API keys, settings all guarded |
| Timing-safe secret comparison | ✅ Implemented | `crypto.timingSafeEqual` |
| Session management | ✅ Implemented | 8h timebox, 1h inactivity, revocation on removal |
| Security headers | ✅ Implemented | CSP, HSTS, X-Frame-Options, Permissions-Policy |
| CORS | ✅ Implemented | Allowlist-based, known origins only |
| Secrets in Vault | ✅ Implemented | Per-workspace Vault, no prod env fallback |
| GDPR data export (Art.15/20) | ✅ Implemented | `GET /api/contacts/[id]/gdpr` |
| GDPR right to erasure (Art.17) | ✅ Implemented | `DELETE /api/contacts/[id]/gdpr` |
| GDPR data retention policy | ✅ Implemented | `data_retention_days` per workspace |
| PII pseudonymization for AI | ✅ Implemented | `pii-redactor.ts`, per-workspace toggle |
| Open redirect protection | ✅ Implemented | `isSafeRedirect()` in auth callback |
| Input validation | ✅ Implemented | Zod on all key routes |
| Session revocation | ✅ Implemented | `signOut` on member removal |
| RBAC | ✅ Implemented | 4 roles enforced at all routes |
| API key scoping | ✅ Implemented | workspace\_id filter on all key operations (BORD-154) |
| Audit logging (write operations) | ✅ Implemented | Workspace-scoped `audit_logs` table, member changes, GDPR erasures, secret updates (BORD-158) |
| Consent ledger | ✅ Implemented | Per-contact consent tracking with opt-in/opt-out history (BORD-193) |
| Webhook isolation | 📋 Planned | BORD-157: phone\_number\_id routing table |
| JWT workspace claims | 📋 Planned | BORD-155 |
| Edge middleware auth | 📋 Planned | BORD-156 |
| Read-access audit logging | 📋 Planned | BORD-168 |
| Tamper-evident audit logs | 📋 Planned | BORD-168 |
| Rate limiting per workspace | 📋 Planned | BORD-162 |
| Dependency scanning (SBOM) | 📋 Planned | BORD-170 |
| Column-level PII encryption | 📋 Planned | BORD-171 |
| Incident detection | 📋 Planned | BORD-166 |
| Breach notification workflow | 📋 Planned | BORD-166 |
| MFA enforcement | 📋 Planned | Supabase TOTP available |
## Detailed Documentation
Workspace isolation model, context resolution, and message dispatch isolation.
Session management, RBAC, API keys, password policy, and MFA.
PII handling, data subject rights, pseudonymization, and sub-processors.
Supabase Vault, security headers, TLS, and encryption at rest.
Audit trail, observability, and planned breach notification.
Full control mapping across ISO 27001, GDPR, NIS2, HIPAA, and SOC 2.