Security at Robo Team Hub

Encryption

• Encryption at Rest: All sensitive data is encrypted using industry-standard AES-256-GCM encryption before being stored in our database
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (HTTPS)
• End-to-End Security: Your data is protected throughout its entire lifecycle, from creation to deletion

Database Security

• Supabase Infrastructure: Our database is hosted on Supabase, a secure PostgreSQL database platform with enterprise-grade security
• Row Level Security (RLS): Database-level access controls ensure users can only access their own data and authorized team data
• Automated Backups: Regular automated backups ensure data recovery in case of any incident
• Data Isolation: Each team's data is logically isolated to prevent unauthorized access

Secure Authentication

• Clerk Authentication: We use Clerk, a SOC 2 Type II certified authentication platform trusted by thousands of applications
• Multi-Factor Authentication (MFA): Optional MFA adds an extra layer of security to your account
• Secure Password Storage: Passwords are hashed using bcrypt with salt, never stored in plain text
• Session Management: Secure session tokens with automatic expiration and refresh mechanisms

Access Control

• Role-Based Access Control (RBAC): Different permission levels for team administrators, members, and regular users
• Principle of Least Privilege: Users only have access to the data and features they need
• Team Isolation: Team data is only accessible to authorized team members
• Session Monitoring: Track active sessions and revoke access from any device

Security Headers & Protection

We implement comprehensive security headers using Helmet.js to protect against common web vulnerabilities:

• Content Security Policy (CSP): Prevents cross-site scripting (XSS) and code injection attacks
• HTTP Strict Transport Security (HSTS): Forces secure HTTPS connections with a 1-year max-age policy
• X-Frame-Options: Prevents clickjacking attacks by denying iframe embedding
• X-Content-Type-Options: Prevents MIME type sniffing attacks
• Referrer Policy: Controls referrer information to protect user privacy
• XSS Filter: Additional XSS protection for legacy browsers

Input Validation & Sanitization

• Server-Side Validation: All user input is validated and sanitized on the server
• SQL Injection Prevention: Parameterized queries and prepared statements prevent SQL injection
• CSRF Protection: Built-in Next.js CSRF protection for all state-changing operations
• Rate Limiting: Protection against brute force and DDoS attacks

Third-Party Security

We carefully select security-focused third-party providers:

Account Security Controls

• Session Management: View all active sessions and revoke access from any device at any time
• Device Management: Trust or revoke specific devices for enhanced security
• Security Events Log: Track login attempts, password changes, and other security events
• Password Management: Change your password anytime and receive notifications of password changes

Manage these settings in your Security Settings.

Ongoing Security Efforts

• Security Monitoring: Continuous monitoring of systems for suspicious activity and potential threats
• Regular Updates: Frequent updates to dependencies and libraries to patch known vulnerabilities
• Code Reviews: Security-focused code reviews before deploying any changes
• Access Logging: Comprehensive logging of all access to sensitive data and systems
• Least Privilege Principle: Internal access controls ensure employees only have access to data necessary for their role