We sell trust. We practice it.
A platform that stores your security posture, evidence, and audit artifacts has to meet a high bar. Here's exactly how SecuryxAI is built — no marketing fluff.
This page describes real, implemented capabilities — not roadmap promises. Items on the roadmap are clearly labeled as such.
Multi-Tenant Isolation Architecture
How orgId enforcement works on every request
1
Request arrives
HTTP request to any /api/* route or Server Component
2
Session resolved
getSessionOrg() calls getServerSession(authOptions) → extracts userId + orgId from JWT. Never trusts client body.
3
RBAC checked
If requiredAction provided, can(role, action) is evaluated. Returns 403 if insufficient.
4
Prisma query
Every org-scoped query includes WHERE orgId = session.orgId. No orgId from client ever reaches the database.
5
Response returned
Data is strictly org-scoped. Cross-tenant access is architecturally impossible — not just policy.
Security by design.
Six areas where we made deliberate architectural decisions — not just configuration choices.
Multi-Tenant Isolation
Architecture
Every query is scoped to the session-derived orgId. We never trust orgId from the client. Prisma has no row-level security — instead every query carries a mandatory WHERE orgId = {session.orgId} clause enforced at the application layer.
- orgId resolved from JWT, never from client
- Prisma extended client with automatic orgId injection
- Cross-tenant data access is architecturally impossible
Authentication & RBAC
Access control
NextAuth v4 with credentials provider and bcrypt (cost factor 12). Sessions use JWT with 8-hour lifetime and 1-hour refresh. RBAC enforces six roles: OWNER, ADMIN, CONTRIBUTOR, REVIEWER, AUDITOR, VIEWER.
- bcrypt cost-factor 12 password hashing
- Login rate limiting (5 attempts / 15 min window)
- RBAC: 6 roles, 12+ actions, enforced on every API route
Immutable Audit Log
Audit trail
Every significant action — control status changes, evidence uploads, approval decisions, policy changes — is appended to an immutable AuditLog table. Logs cannot be deleted or modified by any role.
- Append-only AuditLog model
- Captures actor, action, target, metadata, timestamp
- Org-scoped; accessible to OWNER/ADMIN for compliance review
Evidence & Data Security
Data handling
Evidence is stored as URLs or metadata references — files are not stored in-database. All connections use TLS. Database is hosted on Supabase PostgreSQL with connection pooling and a dedicated direct URL for migrations.
- TLS in transit
- No file content stored in database
- Supabase PostgreSQL with RLS-ready schema
Questionnaire Intelligence Privacy
AI processing
Questionnaire matching runs entirely on the application server using the org's own control library as the answer corpus. No customer data is sent to external AI APIs for processing. The intelligence engine is deterministic and local.
- No external AI API calls with customer data
- Matching uses org's own control library
- Confidence scoring is deterministic (no LLM)
Trust Center Architecture
Public disclosure
The public Trust Center is rendered server-side with no session context — it only displays what the org has explicitly published. NDA-gated documents require email capture before content is revealed. Share tokens are time-limited.
- Published flag required to expose any data
- NDA gate enforced server-side
- Shareable links can have expiry dates
Two-Factor Authentication
Account security
Every account can enable TOTP-based two-factor authentication with any standard authenticator app. One-time recovery codes provide backup access if a device is lost. Enabling or disabling MFA signs out every other active session.
- Works with Google Authenticator, Microsoft Authenticator, 1Password, Authy, Bitwarden
- 10 single-use recovery codes, regenerable at any time
- Every attempt is rate-limited and audit-logged
Security roadmap.
What's coming next — and what the architecture already supports.
SAML 2.0 SSO
Enterprise single sign-on for organizations standardized on a SAML identity provider.
Google Workspace SSO
Sign in with a Google Workspace account, restricted to your organization's domain.
Microsoft Entra ID SSO
Sign in with a Microsoft Entra ID (Azure AD) account, scoped per organization.
SCIM User Provisioning
Automated user lifecycle management for enterprise identity providers.
SOC 2 Type II Audit
SecuryxAI eats its own cooking. We will publish our own SOC 2 report.
Security questions? We answer them directly.
If you have a security questionnaire for us, we'll fill it in with SecuryxAI — and show you the result.