Legal

Security at Harkly

The short version: one tenant can never read another's data, every admin action is on the record, and the whole thing is open source so you can check.

Architecture

  • Two tiers. A public gateway does rate limiting and strips headers a caller could forge; a private core owns every decision about who may see what. Core is not reachable from the internet.
  • Tenant isolation in the application layer. Every query runs inside a tenant context (runWithTenant) that carries the org and the actor. Routes declare requireTenant(); there is no code path that reads org data without one. Tests run every route against a real database.
  • Least privilege for end users. A public key alone can identify a user and never change an email; changing identity needs a JWT signed with the org's secret or an API key. Widgets and the portal never see admin tokens.
  • Roles. Owner, admin, agent, viewer, with the last owner protected from demotion. Every permission check is a named rule in packages/domain, 100 % covered.

Data

  • In transit: TLS 1.2+ everywhere, HSTS on every hostname.
  • At rest: Postgres volumes encrypted by the host; third-party tokens (Slack, Linear, Jira, CRM, APNs keys) additionally encrypted with a dedicated key that lives only in the running service's environment.
  • Secrets never enter source control or logs. Sign-in codes go out by email and expire in minutes; there are no passwords to leak.
  • Regions. An org's data stays in the region it was created in (regions.md).
  • Retention. Per-type retention policies with a nightly purge, per-user export and delete from the dashboard and the API.
  • Backups daily on the database host, encrypted, kept for 30 days.

Operations

  • Audit log. Every change by an admin, an API key or an automation is recorded with who, what, before and after. Exportable as CSV.
  • Access to production is limited to the engineers who run it, behind two-factor authentication, and logged by the hosting providers.
  • Deploys go through a promotion workflow that requires green tests, 90 % coverage on every source directory, static analysis, and a duplication check. Every release is tagged and verifiable at /version.
  • Dependencies are pinned by lockfile and reviewed on update; SDKs are published from CI with npm provenance, never from a laptop.
  • Monitoring. GET /status reports the API, database, worker and email components per region and feeds the status page.

Reporting a vulnerability

Email security@harkly.app. We answer within two business days, fix confirmed issues before disclosing them, and credit you if you want. Please don't test against other customers' workspaces; a self-hosted install is the right place to poke.

Compliance

  • GDPR / UK GDPR: DPA with the Standard Contractual Clauses incorporated, and a sub-processor list.
  • SOC 2: not yet. The controls above are what an audit would examine; we will publish the report when there is one.