Comment nous opérons en production.

• Passwords

  Never stored in plain text. A scrypt hash with a 16-byte random salt per account, compared in constant time. Minimum 12 characters, a number and a symbol required.

  Source: lib/auth.ts (hashPassword, verifyPassword, validatePasswordStrength)

• Sessions

  HMAC-SHA256 signed cookies, httpOnly, secure, SameSite=Lax, 30-day expiry. The server refuses to start in production without a real signing secret: there is no fallback secret to fall back to.

  Source: lib/auth.ts (setSession, SECRET resolver)

• Transport

  HSTS with preload and includeSubDomains, X-Frame-Options DENY, X-Content-Type-Options nosniff, a Content-Security-Policy restricting script/style/connect sources to a named allowlist, Cross-Origin-Opener-Policy same-origin, and a Permissions-Policy that denies camera, microphone, geolocation and USB by default.

  Source: next.config.ts (headers()), netlify.toml

• GDPR data residency

  For EU actors, AI requests are never routed to a model provider whose home jurisdiction has no EU adequacy decision: enforced fail-closed in code from a single source of truth and covered by tests. This is a jurisdiction floor, not a full GDPR Chapter V transfer assessment for every provider still in scope.

  Source: lib/llm-residency.ts, __tests__/eu-residency.test.ts

• AI request boundaries

  Every agent request is rate-limited per IP, bounded to a fixed number of tool calls, and cut off by a hard wall clock under a minute. Untrusted content (an email body, a page an audit reads) is fenced with delimiters and the model is instructed to treat it as data, never instructions.

  Source: app/api/agent/route.ts, app/api/extension/email-scan/route.ts

• Document uploads

  Vault files are verified by reading each file’s actual leading bytes rather than trusting its declared type, capped per member at 50 documents and 250 MiB, 4.5 MB per file.

  Source: lib/document-limits.ts, lib/documents.ts

• Deletion

  A verified deletion request purges every store this repo tracks for that email: personal account rows and every org seat it ever held: listed in full at retention. Audit rows keep only a one-way hash of who acted, never the plaintext email.

  Source: lib/data-stores.ts, lib/erase-user.ts, lib/org-deletion.ts

Les prestataires sont listés sur sous-traitants. Ce que chaque niveau envoie hors de l'appareil figure sur flux de données. Les clients Enterprise peuvent demander un accord de traitement des données signé.