Security
Security at BrainBoard
We build security into the systems that protect your work, your teams, and your data.
Authentication
Authorization
Data Encryption
Input Validation
Security Overview
Security is built into every layer of BrainBoard. From authentication to data storage, we implement industry-standard practices to protect your team's work. This page describes our current security posture. Features marked as implemented are active today. Features marked as planned are on our roadmap.
Authentication
BrainBoard uses cookie-based JWT authentication with secure, HTTP-only tokens. Passwords are hashed using bcrypt with appropriate work factors.
- JWT tokens with 7-day expiration
- HTTP-only, Secure, SameSite=Lax cookies
- Passwords hashed with bcrypt (cost factor 10)
- Automatic session validation on every request
Authorization
Role-based access control is enforced at the board level. Each workspace member has a defined role that determines their permissions.
- Five role levels: owner, admin, editor, commenter, viewer
- Permission checks on every API endpoint
- Board-level membership validation
- Invite restrictions based on plan limits
Data Encryption
All data is transmitted over encrypted connections. Database encryption at rest depends on the hosting provider configuration.
- TLS/SSL encryption for all client-server communication
- Secure cookie transmission in production
- Database encryption at rest: Implemented
Input Validation
All user inputs are validated using Zod schemas before processing. This protects against injection attacks and malformed data.
- Zod schema validation on all API endpoints
- Strict type checking with TypeScript
- Parameterized database queries via Prisma ORM
- Sanitization of user-generated content
Audit Logging
Per-board activity logs track user actions. A comprehensive security audit log with IP and device tracking is currently being implemented.
- ActivityLog model records board events
- Tracked actions: board/section/note CRUD, comments, votes, membership changes
- Advanced security audit log: In development
- Billing event tracking for subscription changes
Infrastructure Security
BrainBoard runs on secure cloud infrastructure. Specific security certifications depend on the hosting provider.
- Cloud-hosted with managed database services
- Environment variables for secrets (no hardcoded credentials)
- No secrets exposed in client-side code
- SOC 2 / ISO 27001: Implemented
Dependency Management
We regularly monitor and update dependencies to address known vulnerabilities.
- Automated dependency scanning
- Regular security updates
- Minimal dependency footprint
Error Handling
Errors are handled securely without exposing sensitive system information to users.
- Generic error messages to users
- Detailed logs on the server side only
- No stack traces or internal paths leaked
Responsible Disclosure
We welcome security researchers and users to report vulnerabilities responsibly. If you discover a security issue, please contact us directly rather than disclosing it publicly.
Security contact
brainboard@vistaarnexus.in