Information Security Policy

1. Purpose

This Information Security Policy establishes the security controls, standards, and practices that Sales Advisor implements to protect customer data, platform infrastructure, and business operations. This policy applies to all systems, data, and personnel involved in the operation of the Sales Advisor platform.

2. Authentication & Access Control

Sales Advisor enforces the following authentication and access controls:

• Password Requirements: Minimum 8 characters. All passwords are hashed using bcrypt with appropriate salt rounds before storage. Plain-text passwords are never stored or logged.
• Multi-Factor Authentication (MFA): TOTP-based two-factor authentication is available for all accounts, compatible with Google Authenticator, Authy, and other standard authenticator apps. MFA secrets are encrypted at rest using AES-256-GCM.
• Recovery Codes: When MFA is enabled, one-time-use recovery codes are generated and encrypted at rest. Each code can only be used once and is permanently invalidated after use.
• Single Active Session Enforcement: Only one active session is permitted per account at any time. New login attempts are blocked if an existing session is active, preventing credential sharing and unauthorized concurrent access.
• Session Management: Sessions are stored server-side in the database. Session cookies are configured with httpOnly and secure (in production) flags. Sessions automatically expire after 8 hours of inactivity.
• Brute-Force Protection: Database-backed tracking of login attempts. After 5 failed attempts within 1 hour, the account is locked for 15 minutes. This protection is cluster-safe across all application instances.
• Role-Based Access Control: Three permission levels (admin, manager, rep) control access to platform features and data within each organization.

3. Encryption Standards

• Data in Transit: All communications are encrypted using TLS/HTTPS. No unencrypted HTTP connections are accepted.
• Data at Rest — Credentials: All third-party API keys, OAuth tokens, voice calling credentials, and MFA secrets are encrypted using AES-256-GCM with unique initialization vectors (IVs) per record.
• Data at Rest — Passwords: User passwords are hashed using bcrypt and never stored in plain text.
• Data at Rest — Database: The PostgreSQL database is hosted on Neon, which provides encryption at rest for all stored data.
• Key Management: Encryption keys are stored as environment secrets, managed through the hosting platform's secret management system, and are never committed to source code or logged.

4. Network & Application Security

• Security Headers: Comprehensive HTTP security headers are enforced via Helmet.js, including Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Content-Type-Options, X-XSS-Protection, X-Frame-Options (DENY), and Referrer Policy.
• Rate Limiting: Database-backed, cluster-safe rate limiting is applied to all API endpoints. Limits are tiered by subscription level (500–10,000 requests per 15-minute window). Separate rate limits apply to AI agent execution.
• Input Validation: All API inputs are validated server-side using Zod schemas before processing. This prevents injection attacks, malformed data, and unexpected input.
• Image Sanitization: All uploaded images are re-processed through Sharp to strip EXIF data, embedded scripts, and potential malicious payloads before storage.

5. Threat Detection & Monitoring

• Security Logging: All security-relevant events are logged with daily log rotation (retained for 30 days). Logs include timestamps, IP addresses, user agents, request paths, and threat classification.
• Anomaly Detection: Automated detection of path traversal attempts, SQL injection patterns, XSS attempts, shell injection, null byte injection, and known malicious scanning tools (sqlmap, nikto, nessus, acunetix, nmap, etc.).
• Threat Severity Classification: Detected threats are classified as low, medium, high, or critical severity for appropriate response prioritization.
• Audit Trail: All data modifications to key entities (leads, deals, user accounts) are logged in an immutable audit trail with before/after values, user identification, IP address, and timestamp. Sensitive fields (passwords, tokens, secrets) are automatically sanitized before logging.

6. Data Isolation

Sales Advisor implements strict multi-tenant data isolation:

• All data queries are scoped by organization ID at the storage layer, preventing cross-tenant data access.
• No data is shared between organizations.
• API endpoints verify organization membership before returning data.

7. Third-Party Credential Security (BYOC)

Under our Bring Your Own Credentials model:

• Customers provide their own API keys and OAuth credentials for third-party services.
• All credentials are encrypted using AES-256-GCM before database storage.
• Credentials are decrypted only at the moment of use and are never cached in plain text.
• Credentials are never shared between users or organizations.
• Customers can revoke credentials at any time through the platform or directly with the third-party provider.

8. System Health Monitoring

The platform includes a health check system that monitors the status and latency of critical services (database, cache, AI providers). Health endpoints report healthy, degraded, or unhealthy status for operational visibility.

9. Policy Review

This Information Security Policy is reviewed and updated at least annually, or whenever significant changes are made to the platform's security architecture. Questions about this policy may be directed to info@salesadvisor.ca.