Security & Compliance

Data handling

Tenant data is logically isolated by tenantId on every row. The Prisma extension withTenant() enforces row-level filtering so cross-tenant reads are server-side rejected.

Authentication

JWT (access 15 min, refresh 30 days). Optional Google SSO. Password hashing via bcryptjs. Public auth endpoints rate-limited (30 req/min).

Webhooks

All inbound webhooks (/api/webhooks/*) require X-Signature-256 HMAC-SHA256 header keyed by tenant secret. Demo tenant keeps an unsigned escape hatch for integrators.

Logging & auditability

Every business-record mutation lands in AuditLog. Every Azure OpenAI call lands in AILog with token counts and cost. Admins access both at /settings/audit-log and /settings/ai-log.

Production hardening

• Helmet HTTP security headers
• Strict CORS allowlist in prod (only 4b2b.ai)
• Express rate limit on /auth, /webhooks, /copilot
• nginx + Let’s Encrypt TLS & HSTS

More detail: /trust