Security at StreamlineOS

We optimize for boring, audited primitives over clever, untested ones. We pay for hosted services with strong security postures (Vercel, Neon, Cloudflare) instead of rolling our own. We minimize the surface area: less code, less custom infrastructure, fewer subprocessors. Where we can't avoid risk, we make it visible — through audit logs you can read and access controls you can configure.

• Application: hosted on Vercel — edge-rendered Next.js with automatic TLS termination, DDoS protection, and immutable deployments.
• Database: Neon Postgres in ap-southeast-1 by default. Logical isolation per organization is enforced at the application layer via row-level filters; physical isolation is available on Enterprise.
• File storage: Cloudflare R2 with server-side encryption, pre-signed URLs scoped per organization, and CORS restrictions.
• Realtime: Ably for chat and presence. Tokens are short-lived and channel-scoped; no client ever holds an org-wide credential.
• Background jobs: Inngest. Job payloads are encrypted at rest and scoped to a specific org context.

• In transit: TLS 1.2+ everywhere. HSTS enabled with a 2-year max-age and includeSubDomains. We score A+ on Qualys SSL Labs.
• At rest: AES-256 for database storage (Neon-managed), R2 object storage, and encrypted backups.
• Application-layer: sensitive fields (e.g. integration API keys, TOTP secrets) are encrypted with an org-specific derived key before being written to the database. The master key never leaves the application's secret store.

• Password hashing: bcrypt with cost factor 12. Plaintext passwords never touch disk.
• MFA: TOTP-based (Google Authenticator, 1Password, Authy) available to every user. Workspace owners can require it for the whole org.
• SSO/SAML: available on Enterprise.
• Sessions: rotating JWT refresh tokens, 30-day expiry, idle timeout of 30 days for the dashboard. Active sessions are listed in your account settings; you can revoke any of them.
• Lockouts: exponential backoff after failed login attempts; full lockout after 10 attempts within 15 minutes.
• IP allow-listing: configurable per organization.

Every action in StreamlineOS is gated by a role-based permission system. Out-of-the-box roles are Organization Owner, Organization Admin, Module Owner, Module Admin and Module Member, DESIGN, plus branch-scoped variants. Permissions are checked on the server, never on the client.

Every privileged action — payroll runs, role changes, mass exports, payslip downloads — is recorded in the audit log with timestamp, actor, IP, and a tamper-evident hash. Audit logs are retained for 13 months and exportable on demand.

• Application secrets live in Vercel's encrypted environment store; they don't enter the repository.
• Production access is restricted to a small set of engineers, every access is logged, and credentials are rotated quarterly (or immediately on offboarding).
• Integration API keys you bring into the workspace (Razorpay, Ably, etc.) are encrypted application-side before storage and decrypted only inside the request that needs them.

• Static analysis: ESLint and TypeScript run on every commit; the build fails on any error.
• Dependency scanning: automated weekly via GitHub Dependabot; high-severity advisories are patched within 72 hours.
• Branch protection: all production deploys require a PR with at least one reviewer and a passing CI pipeline. No direct pushes to main.
• Content Security Policy: strict CSP with nounsafe-eval, frame-ancestors set to none, and X-Frame- Options DENY.
• OWASP Top 10: tracked as part of our quarterly review. We specifically audit for injection, broken access control, and SSRF before each release.

• Database backups: point-in-time recovery for the last 30 days (Neon).
• File storage: R2 supports object versioning; deleted objects are recoverable for 30 days.
• RPO target: 5 minutes.
• RTO target: 4 hours for the application; 1 hour for read-only mode.
• Disaster drill: we run a recovery exercise quarterly.

• Real-time monitoring with on-call rotation. Critical alerts page the engineer on duty within 60 seconds.
• We publish a public status page; incidents are posted within 30 minutes of detection.
• We follow a documented incident response runbook with severity levels, comms templates, and a post-incident review for any Sev-1 or Sev-2 event.
• For incidents that affect customer data we notify the workspace owner within 72 hours and publish a post-mortem within 14 days.

We're building toward formal certifications. The current state is honest, not aspirational:

• GDPR: our practices align with the regulation; the practical controls are documented in our Privacy Policy and DPA (available on Enterprise).
• SOC 2 Type II: Type I report in progress. Type II audit scheduled once we've been operating the relevant controls continuously for six months.
• ISO 27001: we operate the equivalent control set; certification is on the 2027 roadmap.
• India DPDP Act 2023: compliant. We treat the workspace owner the “data fiduciary” for their content; we act as the “data processor.”

We're grateful for the security research community. If you've found something, please:

• Email support@streamlineos.in with a clear description and reproduction steps.
• Give us 90 days to respond before publishing.
• Don't exfiltrate data beyond proof-of-concept, don't test against customer workspaces, and don't run automated scanners without prior approval.

In return we'll acknowledge your report within 48 hours, keep you updated, and credit you (with your permission) once the issue is fixed. We don't currently run a paid bounty programme but we send thank-you swag and recommendations on request.

For security questionnaires, pen-test reports, or due-diligence requests during enterprise procurement, write to support@streamlineos.in. We respond within two business days.