Security is an architectural constraint, not a checkbox.

Application hosted on Vercel with global CDN, automatic DDoS mitigation, and edge network protection across 100+ regions.

Database hosted on Supabase (PostgreSQL) with automated daily backups, point-in-time recovery up to 7 days, and multi-region replication.

All infrastructure components operate within SOC 2 Type II certified data centers.

99.9% uptime SLA on Professional and Enterprise plans. Status available on request.

All traffic encrypted with TLS 1.3. Unencrypted HTTP connections are rejected and redirected to HTTPS.

API rate limiting enforced via Arcjet on all endpoints — including authentication, platform API, and webhook routes.

CORS policies restrict cross-origin requests to explicitly authorized domains only.

Webhook payloads validated with cryptographic HMAC signatures to prevent tampering.

Content Security Policy headers set on all application responses.

In transit: TLS 1.3 with forward secrecy for all connections between client, browser extension and server.

At rest: AES-256 encryption for all stored data via Supabase managed encryption, with automatically rotated keys.

Secrets: all credentials, API keys and configuration managed via Doppler. Zero plaintext secrets exist in the codebase, environment files or version control history.

Row-level security policies enforced on every table. No query can return another organization’s data — enforced at the database layer, not the application layer.

All queries specify exact columns. No SELECT * is permitted anywhere, enforced by automated review gates on every pull request.

Organization identifiers validated at the middleware layer on every request, before any business logic executes.

Audit logs are tamper-evident via cryptographic JWT signing; any modification invalidates the signature. Stored separately from application data and immutable once written.

Retention: audit events for 24 months, access logs for 90 days.

TypeScript strict mode across the entire codebase with a zero-error build policy. No type suppressions without documented justification.

Automated security gates run on every push via CI/CD before any deployment reaches production.

Prompt injection defense: all LLM inputs structurally separate user-controlled data from system prompts. Customer personal data is never passed directly into model prompts.

Per-organization AI token budgets with circuit breakers prevent abuse and runaway costs affecting other customers.

Input validation on all API endpoints with strict Zod schema enforcement. Malformed requests are rejected before business logic.

CSRF protection on all state-mutating requests.

Dependency scanning via automated tooling. Known vulnerable packages are flagged and updated within 7 days of disclosure.

Authentication managed via Clerk with configurable session timeouts, MFA support and session revocation.

Three-tier role-based access control — Owner, Admin, Member — with granular permission scoping at the organization level.

Multi-factor authentication available on all plans and enforced by default on Enterprise plans.

All Draxion employee access to production requires MFA and is individually logged. No shared credentials are used.

Least privilege applied to all internal access; engineers reach only the production resources their role requires.

Production database access requires documented justification and is time-limited.

Offboarding revokes all system access within 4 hours of departure.

The extension operates with minimum required permissions. It does not request browsing history, bookmarks, downloads, or any data outside the AI tool domains it is configured to monitor.

DLP scanning occurs entirely client-side in the browser. Raw content of employee inputs is never transmitted to Draxion servers — only the classification result, such as “PII detected”.

The extension communicates with Draxion servers exclusively over TLS 1.3, with authentication tokens validated server-side on every request.

Extension code is reviewed before every release and submitted to Google’s Chrome Web Store review process.