Security Architecture
Security standards, data encryption, tenant isolation, and compliance safeguards in OutRiskAI.
OutRiskAI is engineered to protect sensitive legal contracts, proprietary agreements, and business metadata. This document outlines our multi-layered security controls.
OutRiskAI does not use your uploaded contracts to train public AI models. Your contract data remains isolated to your tenant workspace.
Multi-Layered Security Controls
┌─────────────────────────────────────────────────────────────┐
│ Security Pillars │
├───────────────────┬───────────────────┬─────────────────────┤
│ In-Transit │ At-Rest │ Authentication │
│ TLS 1.3 enforced │ AES-256 Storage │ NextAuth.js OAuth & │
│ on all endpoints │ & Hashed Keys │ Scoped Bearer Keys │
└───────────────────┴───────────────────┴─────────────────────┘1. Data Encryption Standards
In-Transit Encryption
All HTTP requests are enforced over TLS 1.3 (or TLS 1.2 minimum). Unencrypted HTTP connections are automatically redirected to HTTPS.
At-Rest Encryption
Uploaded contract documents binaries stored in Object Storage (DigitalOcean Spaces / AWS S3) are encrypted using AES-256 server-side encryption. Database storage in PostgreSQL employs disk-level encryption.
2. API Key Security & Secret Hashing
Public REST API keys (ork_live_...) follow cryptographically secure generation patterns:
- A random 32-byte token with prefix
ork_live_is generated when requested. - The full plain-text secret is displayed exactly once to the user in the UI.
- The server computes a
SHA-256hash of the key and persists only the hash (keyHash) in PostgreSQL. - When incoming API requests arrive, the Bearer token is hashed and matched against database records in constant time.
3. Tenant Isolation & Access Control
- Database-Level Scoping: Every contract query enforces
WHERE userId = session.user.id, preventing cross-tenant data access. - Scoped API Tokens: API keys carry discrete permissions (
documents:read,documents:write). Operations attempting actions outside token scopes are rejected with HTTP403 Forbidden.
4. Input Validation & SSRF Prevention
When registering contracts via public HTTPS URLs (POST /documents):
- Only
https://URLs on port 443 are permitted. - Hostnames are resolved and validated before connection to ensure they do not target private IP spaces (
10.0.0.0/8,192.168.0.0/16,127.0.0.1, link-local, or cloud metadata endpoints). - Redirects are limited to 3 hops, re-verifying safety on each hop.