Security

All data is hosted on Supabase (PostgreSQL on AWS), with encryption at rest (AES-256) and in transit (TLS 1.2+).

Application and worker services run on Railway with automated TLS, isolated containers per service, and zero-downtime deploys.

Redis (BullMQ queues) uses Railway-managed persistence with AOF durability enabled.

All communication between services happens over private internal networks — no public exposure of queue workers or internal APIs.

Multi-factor authentication (MFA) via TOTP is available to all users, and required as a step-up challenge for sensitive actions like account and organization deletion.

Passwords are hashed using Supabase Auth (bcrypt). We never store plaintext credentials.

Sessions are managed with short-lived JWT tokens via @supabase/ssr — cookies are HttpOnly and SameSite=Lax.

Row Level Security (RLS) is enabled on every database table. Data is strictly scoped to the owning organization — no query can access another org's data, even if the application layer had a bug.

Team members are assigned roles (Owner, Admin, Member) with permissions enforced at the API and database layers.

API keys are stored as SHA-256 hashes — the plaintext key is shown once at creation and never stored.

All API routes are rate-limited via Upstash Redis (edge-compatible) to prevent abuse and brute-force attacks.

Inbound webhooks (Stripe, Resend, booking platforms) are verified using HMAC-SHA256 signatures with timingSafeEqual comparison to prevent timing attacks.

Outbound webhooks support per-endpoint signing secrets so your receiving servers can verify payloads originated from CognitivPulse.

Website pixel tokens are cryptographically unique UUIDs — they cannot be enumerated or guessed.

GDPR: Contacts can request a full data export or deletion at any time. Requests are processed through a dedicated API and audit-logged. Consent is tracked per contact.

TCPA: Every SMS send is gated through a compliance check — opt-in status, quiet hours (timezone-aware), and per-contact frequency limits are all enforced before any message is sent. Non-compliant sends are marked skipped with a reason code, never silently dropped.

Unsubscribe handling is built into the email delivery pipeline — one-click unsubscribes are processed immediately and respected on all future sends.

AI-generated content is checked against industry compliance packs (healthcare, dental, finance, real estate, legal, fitness, supplements) before any campaign is scheduled.

Each organization is a fully isolated tenant. RLS policies ensure that all reads and writes are scoped to the authenticated user's organization at the database level.

Social OAuth tokens are encrypted at rest using AES-256-GCM with a TOKEN_ENCRYPTION_KEY secret — losing this key would require users to reconnect their accounts (it is never derivable from stored data).

No customer data is used to train AI models. Prompts sent to OpenAI follow their API data usage policies — input and output are not used for model training under the API agreement.

All unhandled exceptions and worker failures are captured by Sentry with full job context (queue, payload, stack trace).

Structured logs are emitted via Pino to Railway's log aggregation — searchable and retained for 30 days.

Every admin action (plan changes, user suspension, feature flag overrides) is written to an immutable audit log with actor, timestamp, and before/after state.

A public health endpoint (/api/health) monitors Database, Redis, Stripe, Email, and AI services continuously.

Supabase Pro provides daily automatic backups with 7-day retention and point-in-time recovery (PITR) with 30-day retention.

BullMQ queues use Redis AOF persistence — jobs survive Redis restarts and are retried automatically when workers reconnect.

Failed jobs are moved to a dead-letter state (not silently discarded) and are inspectable and retryable from the admin queue dashboard.