⚡
FlashCat.aiAI BOS

The AI Business Operating System

🛡️Legal & Security

Security & RBAC

Technical security architecture, role-based access control, and compliance posture.

Version 1 · Effective 28 July 2026

🛡️Security & RBAC
Published v1

Security Architecture & Role-Based Access Control (RBAC)

Effective Date: 2026-07-28
Platform: SAVHN AgencyOS · https://agencyos.savhn.in
Security Contact: legal@savhn.in

Developer Note: This document is maintained exclusively by the Platform Developer and reflects the actual, implemented security architecture of SAVHN AgencyOS. It is intended for technical review, compliance audits, and enterprise Customer due diligence.

1. Executive Security Summary

SAVHN AgencyOS is built with a security-first, multi-tenant architecture. Key security properties:

  • Authentication: Stateless JWT (RS256 signed) with per-role expiry policies
  • Authorization: Enforced server-side RBAC at every API endpoint via NestJS Guards (Next.js App Router equivalent on the frontend)
  • Multi-Tenancy: Hard organizational data isolation enforced at the database query layer — every query is scoped by organizationId
  • Data Encryption: TLS 1.3 in transit, AES-256 at rest (via cloud provider encryption)
  • Monitoring: Developer-only system telemetry; no Customer-data surveillance
  • Ethical Standards: Transparent, opt-in employee monitoring only — no covert tracking

2. Authentication Architecture

2.1 JWT-Based Stateless Authentication

SAVHN AgencyOS uses JSON Web Tokens (JWT) for all session management. Key properties:

Property Value
Algorithm HS256 (configurable to RS256 for enterprise)
Payload Fields sub (userId), email, roleName, organizationId
Token Expiry 7 days (default), configurable by Super Admin
Token Refresh Sliding window refresh on active sessions
Storage HttpOnly cookie (preferred) or Authorization header
Revocation Token blacklisting via server-side revocation list on logout

2.2 Login Portals & Portal-Specific Authentication

Three login portals provide cosmetic separation and user-experience clarity, all backed by the same secure authentication endpoint:

Portal URL Intended For
Super Admin Portal /login/superadmin Platform owner, organization Super Admins
Agency Admin Portal /login/admin Agency/organization managers and admins
Team Member Portal /login/employee Individual contributors and staff

Authentication endpoint: POST /api/auth/login
The portal parameter is decorative; actual access is determined by the user's roleName in the JWT payload.

2.3 Password Security

  • Passwords hashed with bcrypt (cost factor 12)
  • Minimum password requirements enforced server-side
  • Password reset via email verification token (time-limited, single-use)
  • Failed login attempt rate limiting (5 attempts per 15 minutes per IP)

2.4 Developer-Level Access

A separate, hidden Developer account (developer@savhn.in) provides platform maintainer access. This account:

  • Is accessible only via /developer/login (not linked from any public-facing navigation)
  • Has access to system telemetry and cross-tenant user management for maintenance purposes
  • Does not have access to Customer business data content (CRM records, invoices, chat messages)
  • All Developer Console actions are logged with timestamps

3. Role-Based Access Control (RBAC)

3.1 Role Hierarchy

SAVHN AgencyOS implements an 11-tier RBAC model. Roles are assigned per-user by Super Admins.

Role Level Key Capabilities
SUPER_ADMIN Tier 1 Full organization control, tenant provisioning, all modules, billing management
MANAGING_DIRECTOR Tier 2 All operational modules, revenue reports, team oversight
COO Tier 2 Operations oversight, project portfolio, workforce summary
CEO Tier 2 Executive dashboards, revenue command center, strategic reports
ADMIN Tier 3 Team management, client approvals, project oversight, HR visibility
HR Tier 4 Employee records, attendance, leave, payroll (if enabled), recruitment
FINANCE Tier 4 Invoices, quotations, expense tracking, AR aging, cash flow
PROJECT_MANAGER Tier 4 Project creation, task assignment, sprint management, time logs
TEAM_LEAD Tier 5 Team task oversight, daily reports, attendance view
CUSTOMER_SUPPORT Tier 5 Support ticket queue, client communications
EMPLOYEE Tier 6 Own tasks, clock in/out, own payslips, team chat, support tickets

3.2 Guard Implementation

Authorization is enforced at the API level via role guards:

@Roles('SUPER_ADMIN', 'ADMIN', 'FINANCE')
@UseGuards(JwtAuthGuard, RolesGuard)
  • Routes without @Roles() are accessible to any authenticated user
  • SUPER_ADMIN always passes every role guard (universal access within their organization)
  • The Developer account bypasses organizational RBAC only for system telemetry endpoints, not business data

3.3 Multi-Tenant Query Isolation

Every database query that touches tenant data includes an organizationId filter derived from the authenticated JWT payload:

// Server-side enforcement — organizationId always comes from JWT, never client
const { organizationId } = req.user;
await db.client.findMany({ where: { organizationId } });

Client-supplied organizationId values are rejected. This prevents horizontal privilege escalation between tenants.

4. Module-Level Access Control

Access to platform modules is controlled at two levels:

4.1 Role-Based Navigation

The sidebar navigation dynamically renders only the modules appropriate for the authenticated user's role:

Module Minimum Role Required
Dashboard (personal) EMPLOYEE
CRM & Leads ADMIN
Finance & Invoicing FINANCE or ADMIN
Full Payroll HR or SUPER_ADMIN
Admin Overview ADMIN and above
Tenant Provisioning SUPER_ADMIN only
Focus Session Gallery (others) ADMIN and above
Focus Session Gallery (own) EMPLOYEE (own sessions only)
Developer Console Developer account only

4.2 Organization-Level Module Toggles

Super Admins can enable or disable specific modules for their organization in Super Admin → Settings → Modules:

  • Payroll (disabled by default)
  • Focus Sessions (disabled by default)
  • GPS Attendance (disabled by default)
  • AI Features (enabled by default)
  • Multi-Currency (enabled by default)

5. Payroll Access Control (Double Opt-In)

Payroll access follows a two-gate consent model:

  1. Gate 1 — Organization: SUPER_ADMIN enables Organization.payrollEnabled = true in Settings
  2. Gate 2 — Employee: Each employee is individually enrolled with Employee.payrollEnabled = true plus their confirmed base salary before any payroll run includes them

Neither gate can be bypassed programmatically. Payroll runs that attempt to include non-opted-in employees are rejected at the service layer.

6. Data Encryption & Transit Security

6.1 In Transit

  • All Platform endpoints served over HTTPS with TLS 1.3
  • HSTS headers enforced (Strict-Transport-Security: max-age=31536000; includeSubDomains)
  • Certificate managed via Let's Encrypt / Hostinger SSL with auto-renewal

6.2 At Rest

  • Database encryption at rest via cloud provider (AES-256)
  • JWT secrets stored as environment variables (never committed to version control)
  • Bcrypt-hashed passwords (never stored in plaintext or reversibly encrypted)

6.3 API Security Headers

All API responses include:

  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY
  • Referrer-Policy: strict-origin-when-cross-origin
  • Content-Security-Policy (configured per deployment environment)

7. WebSocket Security (Real-Time Chat)

Team Chat uses WebSocket connections for real-time messaging:

  • WebSocket connections are authenticated via the same JWT at connection handshake
  • Channel membership is enforced server-side — users can only subscribe to channels they belong to
  • Private/DM channel messages are not broadcast to non-participants
  • WebSocket sessions are terminated immediately upon JWT expiry or user logout

8. Employee Monitoring Security Controls

SAVHN AgencyOS enforces ethical monitoring boundaries as a technical constraint, not just a policy:

Monitoring Type Technical Control
Idle detection Reports only browser tab focus/blur events via heartbeat. No keystroke, click, or application data.
Attendance (QR/GPS) Employee-visible at all times. GPS requires browser geolocation permission prompt.
Focus Session screenshots Requires browser getDisplayMedia() permission prompt (OS-level, cannot be suppressed). OS-level sharing indicator always visible. Employee sees identical gallery as admins.
Scheduled screen-share reviews Appointment and link tracking only. Video conferencing handled by external provider (Zoom/Meet).
Payroll data Double opt-in enforced at DB constraint level. Employee can view their own payslips always.

8.1 What Is Technically Prevented

The following capabilities do not exist in the codebase and cannot be enabled:

  • Silent screenshot capture
  • Keystroke or clipboard logging
  • Per-application usage tracking
  • Randomized or undisclosed monitoring intervals
  • Cross-tenant access to employee data by other tenants' admins

9. Audit Logging & Incident Response

9.1 Current Logging (Implemented)

  • Authentication events: login, logout, failed attempts (with IP and timestamp)
  • Role changes: who changed which user's role, when
  • Payroll run events: initiated by whom, which employees included
  • Developer Console actions: all actions timestamped with developer account attribution

9.2 Pre-Production Requirements

The following audit controls are flagged as pre-production requirements not yet implemented:

  • Comprehensive audit trail for all data mutations (create/update/delete)
  • MFA (Multi-Factor Authentication) for Admin and Super Admin accounts
  • SIEM integration for real-time anomaly detection
  • Automated suspicious-access alerting

These will be implemented before the Platform processes real production Customer data.

10. Vulnerability Disclosure & Security Contact

If you discover a security vulnerability in SAVHN AgencyOS, please report it responsibly:

Security Email: legal@savhn.in
Expected Response Time: 48 hours for initial acknowledgment, 14 days for remediation assessment

Please include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact assessment
  • Your contact information

We do not pursue legal action against good-faith security researchers following responsible disclosure practices.

11. Compliance Posture

Standard Current Status
GDPR (EU) Privacy-by-design architecture; data subject rights implemented; DPA available for EU Customers
SOC 2 Type II Not yet certified — pre-production; audit controls being implemented
ISO 27001 Not yet certified — security framework aligned with ISO 27001 principles
DPDP Act (India) Consent mechanisms and data principal rights implemented
HIPAA Not certified — Platform not designed for PHI; Healthcare Customers must configure accordingly

12. Developer Maintenance Notice

This Security & RBAC document is maintained exclusively by the Platform Developer account. Changes to security architecture must be reflected here within 30 days of implementation. Customer-facing security documentation updates require review and re-publication through the Developer Console → Legal Editor.

Last Updated: 2026-07-28
Document Version: 3.0 (Platform-Specific)
Maintained By: Platform Developer — SAVHN AgencyOS

Last published: 28 July 2026

Questions? Contact legal@savhn.in →