Security Is Built In, Not Bolted On
Defense in depth — from strict application-layer authorization and hardened storage to mandatory administrator 2FA.
Application-Layer Authorization
Every request passes a single authorization pipeline — authentication, workspace context, role, module, and tier checks — before any database query runs. Queries always scope rows to your user, workspace, or organization, and no client ever connects to the database directly. Tables are additionally RLS-enabled (deny-by-default), so a future direct path would return nothing until explicitly allowed.
JWT Authentication
Supabase Auth with bearer JWTs and refresh-token rotation. Sessions are bound to the issuing identity and re-validated against the database on every request.
Mandatory Admin 2FA
Administrators enroll TOTP two-factor authentication (with single-use recovery codes) before the admin portal opens. Failed verification attempts trigger a per-account lockout.
Rate Limiting & Bot Protection
Auth, login, registration, and 2FA endpoints are rate-limited per real client IP — correctly identified behind our proxy chain — with per-path budgets. Registration and password reset additionally require a valid Cloudflare Turnstile token, so brute force and bots stop before they reach the API.
Encrypted Secrets
Sensitive values — including 2FA secrets — are stored AES-GCM encrypted at rest with a dedicated application encryption key, never in plaintext.
Full Audit Logs
Admin actions — subscription changes, impersonation, refunds, promo edits — are written to an immutable audit log with actor, target, and IP. Impersonation sessions are always logged start to stop, and audit logs are purged automatically after 12 months.
Error Monitoring
Sentry captures backend and frontend errors with request context, so issues are diagnosed before users report them. Structured pino logs carry request IDs end-to-end.
Hardened Storage
Uploads are validated by content type and byte size, and images are resized server-side to WebP. Images and videos live in private storage buckets and are served only through short-lived signed URLs — never public links.
Hardened Headers
Every response from the website and the API carries hardened headers: HSTS, content-type sniffing protection, frame protection, and restrictive referrer and permissions policies. A strict first-party-only Content-Security-Policy (currently report-only) keeps third-party scripts out.
Encrypted Backups
Production data is backed up daily to off-site storage, encrypted before it ever leaves our servers, with a restore drill that must pass after any change to the backup system — a lost disk is an inconvenience, not a data-loss event.
Secure Billing
Payments run through Paddle, our merchant of record — card data never touches Treinamos servers and Paddle handles global tax compliance and invoices. Billing webhooks are signature-verified and idempotent, so duplicate or replayed events can never double-charge.