Security

Data Flow

Browser (HTTPS)
  → Cloudflare Pages (static export, no server-side rendering)
  → FastAPI backend (Railway, managed PaaS)
       ├── Railway PostgreSQL (TLS-enforced, provider-managed encryption at rest)
       ├── Egnyte MCP (document search & retrieval, org-level OAuth)
       └── Enterprise AI provider (HTTPS, API-key authenticated)
              Tiered model routing: fast / standard / deep
              Built-in web search (server-side, no third-party search API)

Trust Boundaries

• Frontend → Backend: HTTPS with CORS restricted to explicit origins. Session cookies with HttpOnly Secure SameSite=Strict. No secrets in frontend — only NEXT_PUBLIC_* environment variables (non-sensitive).
• Backend → LLM: HTTPS to our enterprise AI provider. Every request authenticated with a server-side API key. Key validated at startup — the application will not start without it.
• Backend → Database: TLS-encrypted PostgreSQL connections (ssl=require enforced in asyncpg connect args). Credentials injected at runtime via DATABASE_URL environment variable — never committed to source control.
• Backend → Egnyte: Per-user OAuth tokens with encrypted storage. All API calls scoped to configured base path with traversal protection. Per-user token isolation prevents cross-tenant document access.

Key Design Decisions

• Enterprise AI with data protection: AI processing uses our enterprise AI provider, which does not use API data to train models. Only the minimum document context required for each query is sent. Tiered model routing ensures cost-efficient processing.
• Static frontend export: No server-side rendering eliminates SSRF and server-side template injection attack surface on the frontend.
• No data training: Your documents are never used to train or fine-tune any model. The LLM weights are frozen — your data cannot influence model behavior for other customers.

Microsoft Entra ID Token Validation

When a user signs in, the frontend obtains an Microsoft access token via MSAL and sends it to POST /api/auth/azure with a Authorization: Bearer header. The backend performs full cryptographic validation:

User Provisioning

Users are matched by Microsoft Object ID (oid claim) — an immutable identifier that survives email and display name changes. On first login, a Sevrel account is automatically provisioned. Email domain allowlists can restrict which organizations are permitted. Domain checks are re-enforced on every Microsoft login to catch email changes from the identity provider.

Timing Attack Mitigation

All authentication paths execute in constant time regardless of whether the user exists. For password-based flows, a dummy bcrypt hash is verified on user-not-found to prevent account enumeration via timing side channels. Admin email comparisons use hmac.compare_digest() with length padding to eliminate timing oracles.

Cookie Format & Signing

Sessions use a 4-part signed cookie: accountId.expiresAt.sessionId.signature

Cookie Attributes

Server-Side Session Revocation

Every login creates a row in the user_sessions table recording the session ID, user ID, IP address, user agent, creation time, and expiration. On every authenticated request, the backend verifies the session has not been revoked. Administrators and users can invalidate all active sessions across all devices via POST /api/auth/logout-all. Logout sets revoked_at on the session record.

Sliding Session Refresh

When a session passes 50% of its lifetime, the backend automatically re-issues a fresh signed cookie with a new session ID and records it in the database. This prevents active users from being logged out while maintaining a tight absolute expiry window. Refresh only occurs on successful responses (HTTP < 400) and is skipped if the handler already deleted the cookie (logout flow).

In Transit

At Rest

Password Hashing

Internal JWT (Access Tokens)

Role-Based Access Control (RBAC)

Three tiers with least-privilege defaults. New users are assigned viewer by default. The permission matrix is defined as Python frozenset constants — immutable at runtime, preventing accidental mutation or configuration drift.

Enforcement

• Permissions are enforced via FastAPI dependency injection on every endpoint — Depends(require_permission("admin:accounts")). No endpoint can be accessed without passing the permission guard.
• Permission denials are logged as security audit events with the user ID, requested permission, and correlation ID.
• Admin email bypass (for initial bootstrap) uses hmac.compare_digest() with equal-length padding to prevent timing side-channel attacks.

Multi-Tenancy Isolation

Organization-scoped data isolation via org_idforeign keys on core tables (users, conversations, documents, audit logs). All queries are scoped to the authenticated user's organization. Egnyte document access uses per-user OAuth tokens — one user's token cannot access another user's files.

Document Processing

When Sevrel answers a question, it fetches document content from your storage vault in real time and processes it in memory to generate the response. Full document text is not persisted as source-of-truth. Conversation metadata (message text, document names, page numbers, and short excerpts used as citations) is stored in PostgreSQL. Embeddings used for retrieval are stored in pgvector and scoped per organization.

Conversation Storage

What We Do NOT Do

• We do not train or fine-tune models on your data
• We do not share your data with any third party
• We do not log document content to application logs — only metadata (file names, page numbers)
• We do not send your queries or documents to any AI provider outside the single enterprise AI provider we operate

Data Deletion

Users can delete individual conversations or all their data. Deletion removes conversation records, associated messages, and evidence metadata from PostgreSQL. Because document content is never persisted, there is nothing to delete on the document side — your files remain in your Egnyte vault, untouched.

Infrastructure Security

The backend application runs on Railway, a managed PaaS with automated security patching and network isolation. The database (PostgreSQL) is hosted on Railway with TLS-enforced connections and provider-managed encryption at rest. All external API communication (AI provider, Egnyte, Microsoft Graph) uses HTTPS with API key or OAuth authentication.

Cloudflare (CDN & Hosting)

The frontend is served via Cloudflare Pages with automatic HTTPS, DDoS protection, and global CDN distribution. All API requests from the frontend to the backend use HTTPS with session cookie authentication.

API Security

All external API communication is authenticated and encrypted:

API keys and OAuth tokens are never exposed to the frontend. All secrets are injected as environment variables at runtime and validated at application startup.

Database Connection Security

IP Normalization

IPv4-mapped IPv6 addresses (e.g., ::ffff:1.2.3.4) are normalized to their IPv4 form to prevent rate-limit bypass via address format tricks. Behind a reverse proxy, the rightmost IP from X-Forwarded-For is used (trusted proxy appends the real client IP last; leftmost values are attacker-controllable).

Memory Exhaustion Protection

Rate limit tracking dictionaries are capped at 100,000 keys. When exceeded, a forced cleanup evicts stale entries. This prevents memory exhaustion from a botnet hammering unique IPs. Authentication rate limits are additionally backed by PostgreSQL (atomic UPSERT), surviving worker restarts and shared across process instances.

Additional DoS Controls

Chat Request Validation

Content Security

• Document poisoning detection: All uploaded documents are scanned for prompt injection patterns, encoded payloads (base64, hex, percent-encoded), and suspicious metadata before processing.
• Text sanitization: Document text is sanitized before inclusion in LLM prompts — stripping control characters, Unicode direction overrides, and known injection patterns.
• Encoding exfiltration defense: LLM responses are scanned for encoded payloads; detected segments are redacted before reaching the user, with a security audit event logged.
• ZIP bomb protection: DOCX and XLSX files have decompressed size validated (100 MB max) before parsing begins.
• Path traversal prevention: All Egnyte document paths are validated against the configured base path. Invalid paths are rejected before any API call is made.

SQL Injection Prevention

All database queries use SQLAlchemy's parameterized query builder — no raw string interpolation. The ORM layer ensures values are always bound as parameters, never concatenated into SQL.

CORS

Host Header Validation

TrustedHostMiddleware validates the Host header against a whitelist derived from CORS origins. This prevents Host header injection in OAuth redirect URIs and cache-poisoning attacks.

Recorded Events

• auth.login / auth.login_failed / auth.logout / auth.logout_all
• auth.login_via_azure / auth.profile_updated_from_azure
• role_change / admin_account_access / admin_account_disabled
• permission_denied (user ID, requested permission, correlation ID)
• chat_query (user, query text, documents accessed, duration)
• document_ingest / document_access
• email_token_decryption_failed (forensic trail for token compromise investigation)
• session_revoked / encoding_redaction

Correlation IDs

Every request is assigned a UUID correlation ID (from the X-Correlation-ID header if present and valid, or auto-generated). The ID is returned in the response header and attached to all audit events, enabling end-to-end request tracing. Correlation IDs are UUID-format-validated to prevent log injection via control characters.

Integrity & Resilience

Startup Fail-Fast Validation

The application performs comprehensive security validation at startup and refuses to run if critical configuration is invalid:

• SECRET_KEY must be non-empty, non-default, and ≥32 characters
• SECURE_COOKIES=true is required when using PostgreSQL
• Cloudflare Access credentials are required when the LLM URL is production
• Wildcard CORS origins are stripped in production (prevents cookie leakage)
• Non-HTTPS CORS origins are filtered out when secure cookies are enabled
• Trusted hosts are auto-derived from CORS origins if not explicitly set
• JWT algorithm is locked to HS256 — any environment override is rejected