PeopleHub Documentation

Security ​

Comprehensive security approach for PeopleHub platform covering authentication, data protection, compliance, and planned enhancements.

Security Philosophy ​

Defense in Depth: Multiple layers of security from network to application level Zero Trust: Verify every request, never assume trust Least Privilege: Grant minimum required permissions Transparency: Clear about current state vs. production security plan

Current Security Implementation ​

Authentication & Session Management ​

JWT-Based Auth:

  • Access tokens: 4 hours (short-lived)
  • Refresh tokens: 7 days (HTTP-only cookies)
  • bcrypt password hashing (10 rounds)
  • Token refresh mechanism

Session Security:

  • HTTP-only cookies (prevents XSS)
  • SameSite=strict (prevents CSRF)
  • Secure flag (HTTPS only)
  • Token expiry and rotation

Authorization (RBAC) ​

Granular Permissions: 38+ defined permissions Role-Based Access: Multiple roles per user

Access Control Levels:

  • Route-level: Entire pages restricted
  • Component-level: UI elements shown/hidden
  • Data-level: Org hierarchy filtering

Data Encryption ​

In Transit:

  • TLS 1.3 for all API communication
  • HTTPS enforced (CloudFront + API Gateway)
  • Encrypted S3 presigned URLs

At Rest:

  • RDS encryption with AWS KMS
  • S3 server-side encryption (SSE-S3)
  • Encrypted EBS volumes for Lambda

Secrets Management ​

AWS Secrets Manager:

  • Database credentials
  • JWT/cookie secrets
  • External API keys
  • Automatic rotation (planned - every 30 days)

No Hardcoded Secrets: All credentials externalized

Application Security ​

Input Validation:

  • Zod schema validation (backend)
  • React Hook Form + Zod (frontend)
  • SQL injection prevention (Drizzle ORM parameterized queries)

Output Encoding:

  • React automatically escapes JSX
  • API responses sanitized

File Upload Security:

  • Presigned S3 URLs (time-limited)
  • File type validation
  • Size limits enforced

Audit Logging ​

What's Logged:

  • All authentication attempts (success/failure)
  • Data modifications (user, timestamp, old/new values)
  • Permission changes
  • Administrative actions

Storage:

  • Database audit tables
  • CloudWatch Logs
  • 90-day retention

Production Security Roadmap ​

Network Security (Planned) ​

VPC Isolation:

  • RDS in private subnets (no public access)
  • Lambda in VPC with NAT Gateway
  • Security groups with least-privilege rules

Timeline: Before production launch

Web Application Firewall (Planned) ​

AWS WAF:

  • SQL injection protection
  • XSS attack prevention
  • Rate limiting (prevent DDoS)
  • Geo-blocking (compliance requirements)
  • Bot detection

Timeline: Production deployment

Threat Detection (Planned) ​

AWS GuardDuty:

  • Continuous threat detection (24/7)
  • Monitors VPC flow logs, CloudTrail, DNS logs
  • Machine learning-based anomaly detection
  • Alerts for: Unauthorized access, compromised instances, reconnaissance, crypto mining

Timeline: Production deployment

Advanced Monitoring (Planned) ​

AWS CloudTrail:

  • All API calls logged
  • Immutable log storage
  • Compliance audit trail

AWS Config:

  • Resource configuration tracking
  • Compliance monitoring
  • Automated remediation

Timeline: Production deployment

Data Protection & Compliance ​

PII (Personally Identifiable Information) ​

PII Data in System:

  • Employee personal details (name, DOB, address)
  • Statutory information (PAN, Aadhaar, passport)
  • Banking details
  • Contact information
  • Family/dependent details

Protection Measures:

  • Field-level encryption (planned for sensitive fields)
  • Data masking in logs
  • RBAC access control
  • Audit trail of all PII access

GDPR Compliance (EU General Data Protection Regulation) ​

Right to Access: Export employee data via API Right to Deletion: Delete employee data permanently Right to Portability: JSON export of personal data Consent Management: Track consent for data processing Data Breach Notification: Automated alerting system (planned)

Applicability: Client has offices in EU region

DPDP Act Compliance (India's Digital Personal Data Protection Act) ​

Data Minimization: Collect only necessary data Purpose Limitation: Use data only for specified purposes Consent: Clear consent for data processing Data Retention: Defined retention periods Security Safeguards: Encryption, access controls, audit trails

Applicability: Client headquartered in India

SOC 2 Readiness (Planned) ​

Security Controls:

  • Access controls (RBAC)
  • Encryption (at rest and in transit)
  • Monitoring and logging
  • Incident response procedures
  • Vendor management

Timeline: Post-production for enterprise clients

Incident Response ​

Security Incident Types ​

1. Unauthorized Access:

  • Monitor failed login attempts
  • Alert on multiple failures from same IP
  • Automatic account lockout (planned)

2. Data Breach:

  • Immediate notification to security team
  • Forensic investigation via CloudTrail logs
  • Password reset enforcement
  • Customer notification (if required by law)

3. Service Disruption:

  • DDoS attack mitigation (WAF + CloudFront)
  • Automatic failover (Multi-AZ RDS)
  • Communication plan

Incident Response Plan ​

  1. Detection: Automated alerts + manual discovery
  2. Containment: Isolate affected systems
  3. Investigation: Analyze logs, identify root cause
  4. Remediation: Fix vulnerability, restore service
  5. Communication: Notify stakeholders
  6. Post-Mortem: Document learnings, prevent recurrence

Security Best Practices ​

Development ​

  • Pre-commit hooks (TypeScript compilation, linting)
  • Code review for all changes
  • Dependency vulnerability scanning
  • No credentials in code

Deployment ​

  • Separate environments (dev/staging/prod)
  • Manual approval for production deployments
  • Automated security testing (planned)
  • Rollback capability

Operations ​

  • Principle of least privilege (IAM policies)
  • Regular security audits
  • Penetration testing (planned before production)
  • Employee security training

Current State vs. Production ​

Current (Dev/Staging) ​

  • ✅ JWT authentication
  • ✅ RBAC authorization
  • ✅ Data encryption (in transit and at rest)
  • ✅ Secrets Manager
  • ✅ Audit logging
  • Note: Database publicly accessible (password-protected)
  • Note: Lambda not in VPC

Rationale: Development convenience, faster iteration

Production Requirements ​

  • ✅ All current security features
  • ✅ VPC isolation (RDS in private subnet)
  • ✅ AWS WAF enabled
  • ✅ GuardDuty threat detection
  • ✅ CloudTrail + Config
  • ✅ Penetration testing completed
  • ✅ Security compliance audit (SOC 2 track)

Timeline: Before production launch

Security Metrics ​

Target Metrics:

  • Zero unauthorized data access incidents
  • 100% of API requests authenticated
  • <1% false positive rate for threat detection
  • <15 minutes incident response time
  • 100% encryption (in transit and at rest)