Identity & Access
MFA mandatory. 11 roles. Least privilege, everywhere.
Every user account requires multi-factor authentication. JWT access tokens expire every 15 minutes; refresh tokens rotate on a 30-day rolling window and live in HTTP-only, Secure, SameSite cookies. Failed logins trigger exponential backoff and lock the account after 10 attempts.
- MFA mandatory · all accounts, all roles
- JWT 15-min access · 30-day rotating refresh
- 11 roles · fine-grained RBAC at NestJS guard layer
- Google + LinkedIn OAuth · SAML/Okta on roadmap
Encryption & Transport
AES-256 at rest. TLS 1.3 in transit. mTLS internal.
PostgreSQL is encrypted at rest with AES-256. MinIO object storage uses server-side encryption (SSE-S3) with keys managed by the MinIO KMS and rotated annually. Every client-to-API hop is TLS 1.3. Every internal service-to-service call is mTLS.
- AES-256 · database + object storage
- TLS 1.3 client → API, auto HTTP→HTTPS
- mTLS between NestJS API and CorteX microservices
- Annual key rotation · keys stored separately
Data Residency
EU-resident by default. SCCs for every onward transfer.
Primary storage sits on Hetzner VPS in Helsinki, Finland. No hyperscaler dependency — no AWS, no Azure, no GCP for primary data. Cross-border transfers to US AI sub-processors flow through Standard Contractual Clauses combined with explicit user consent. Every transfer has a Transfer Impact Assessment on file.
- Hetzner Helsinki · EU-resident primary data
- PostgreSQL 16 + self-hosted MinIO · no hyperscaler
- SCCs + TIA for US AI sub-processors
- Internal CorteX microservices · never public-facing
Consent & Rights
7 consent purposes. 7-year audit. 30-day DSR SLA.
A two-layer consent system: a live status table, plus an append-only ConsentCapture audit trail that logs every grant, withdrawal, and recapture with IP, user agent, wording version, and channel. All seven data-subject rights are implemented with a 30-day response window. Erasure cascades through profile, portraits, meetings, and connections.
- 7 granular purpose codes · versioned wording
- Append-only audit · 7-year retention
- Access · Erasure · Portability · Rectification · Objection · Restriction · ADM review
- Self-service endpoints · /privacy/consent, /data-subject/export