Multi-tenant data isolation, role-based access control, and security practices aligned with SOC standards.
The Cloud Application Security Assessment (CASA) Tier 2 validates that JSV meets industry-standard security requirements for authentication, authorization, data protection, cryptography, and session management.
HS256 with explicit algorithm allowlists on every verify call site. 512-bit secret entropy. Purpose-isolated tokens prevent cross-token-type attacks.
MFA enforced for owner and admin roles. 6-digit OTP codes via email, SHA-256 hashed before storage. Account lockout after 5 failed attempts.
Every database query includes company_id scoping. No cross-tenant data leakage is possible through standard API routes. Defense-in-depth on UPDATE and DELETE operations.
All multi-step write operations use turso.batch() for atomicity. Invoice creation, payment recording, user registration, and team management are all transactionally safe.
Every endpoint is rate limited via Upstash Redis sliding window. Auth endpoints: 5/minute. AI endpoints: 10/hour. Email endpoints: 20/hour. Configurable per route.
Server-side MIME type allowlists. Magic byte validation on FormData uploads. CDN domain allowlists for URL-based file fetches. No base64 storage in the database.
Access Control
JSV implements a 7-role hierarchy enforced server-side: Owner, Network Admin, Admin, Project Manager, Field Tech, Subcontractor, and Viewer. Each role has explicit permissions checked on every API call.
Individual permissions can be granted or revoked per-user via overrides. Role hierarchy prevents lower roles from managing higher roles. The owner role cannot be assigned via API.
Data Protection
All data queries include company_id scoping for multi-tenant isolation. Sensitive fields are auto-stripped from API responses. OAuth tokens are AES-256-GCM encrypted at rest. Passwords use bcrypt with cost factor 12.
Security events are logged in structured JSON format: login, logout, password change, MFA events, rate limit violations, and authorization denials. Sensitive data is never logged.
For security questions, vulnerability reports, or compliance documentation requests, contact our security team.