# Security & Compliance

This guide explains the security features, data protection measures, and compliance capabilities built into [PromptOwl](https://promptowl.ai) for enterprise users.

---

## Table of Contents

1. [Security Overview](#security-overview)
2. [Authentication and Access](#authentication-and-access)
3. [Data Encryption](#data-encryption)
4. [Role-Based Access Control](#role-based-access-control)
5. [Data Isolation](#data-isolation)
6. [Consent and Privacy](#consent-and-privacy)
7. [Session Management](#session-management)
8. [API Security](#api-security)
9. [Enterprise Security Controls](#enterprise-security-controls)
10. [Security Best Practices](#security-best-practices)
11. [Compliance Considerations](#compliance-considerations)

---

## Security Overview

PromptOwl implements multiple layers of security to protect your data and ensure secure AI interactions.

### Security Architecture

```
User Authentication
         ↓
Session Validation
         ↓
Role-Based Access Control (RBAC)
         ↓
Resource-Level Permissions
         ↓
Data Encryption
         ↓
Secure Cloud Storage
```

### Key Security Features

| Feature | Implementation |
|---------|----------------|
| **Authentication** | OAuth + Credentials |
| **Encryption** | Industry-standard for sensitive data |
| **Access Control** | Role-based (RBAC) |
| **Session Management** | JWT with 7-day expiration |
| **Data Isolation** | User/team/enterprise levels |
| **Consent Tracking** | GDPR-compliant logging |

---

## Authentication and Access

### Authentication Methods

PromptOwl supports two authentication methods:

**1. Google OAuth (Recommended)**
- Secure OAuth 2.0 flow
- No password stored in PromptOwl
- Automatic email verification
- Enterprise SSO integration

**2. Email/Password**
- Industry-standard password hashing
- Email verification required
- Secure password reset flow

### Login Security

| Measure | Description |
|---------|-------------|
| **Password Hashing** | Industry-standard hashing algorithm |
| **Email Verification** | Required for credential login |
| **Session Tokens** | Cryptographically signed tokens |
| **HTTPS Only** | Encrypted in transit |

### First-Time Login

1. User signs up via OAuth or credentials
2. Email verification (if credentials)
3. Consent collection (GDPR compliance)
4. Enterprise auto-assignment (if applicable)
5. Session token issued


---

## Data Encryption

### What's Encrypted

| Data Type | Encryption |
|-----------|------------|
| LLM API Keys | Encrypted at rest |
| Payment Credentials | Encrypted at rest |
| Passwords | Industry-standard hashing |
| Session Tokens | Cryptographically signed |

### API Key Protection

Your LLM provider API keys receive special protection:

**Encryption Process:**
1. User enters API key in settings
2. Key encrypted before storage
3. Encrypted value stored in database
4. Decrypted only at runtime when needed
5. Never displayed after initial save

**Supported Providers:**
- OpenAI
- Anthropic (Claude)
- Google Gemini
- Groq
- Grok (xAI)

### Encryption Standards

| Data Type | Protection |
|-----------|------------|
| **API Keys** | Encrypted at rest |
| **Passwords** | Industry-standard hashing |
| **Sessions** | Cryptographically signed tokens |
| **Network** | TLS encrypted in transit |

---

## Role-Based Access Control

### Role Hierarchy

PromptOwl uses a hierarchical role system:

```
Platform Admin
    ├── Full platform access
    ├── All enterprise management
    └── System configuration

Enterprise Admin
    ├── Enterprise settings
    ├── User management
    ├── Team management
    └── Feature configuration

Enterprise User
    ├── Create prompts
    ├── Access shared resources
    ├── Team collaboration
    └── Limited by settings

Regular User
    ├── Personal resources
    ├── Shared access only
    └── No admin capabilities
```

### Resource-Level Permissions

For individual resources (prompts, artifacts, conversations):

| Role | View | Edit | Delete | Share |
|------|------|------|--------|-------|
| **Owner** | Yes | Yes | Yes | Yes |
| **Editor** | Yes | Yes | No | Yes |
| **Viewer** | Yes | No | No | No |
| **User** | Yes | No | No | No |

### Permission Checks

Every action verifies:
1. User is authenticated
2. User has appropriate role
3. User has access to specific resource
4. Enterprise settings allow the action

### Checking Your Permissions

Your effective permissions depend on:
- Your platform role
- Your enterprise role (if applicable)
- Your team memberships
- Direct sharing to your email

---

## Data Isolation

### Multi-Level Isolation

PromptOwl ensures data separation at multiple levels:

**User Level:**
- All queries filter by user ID
- Personal data never visible to others
- API keys tied to individual accounts

**Team Level:**
- Team resources visible only to members
- Role determines access within team
- Team ownership tracked

**Enterprise Level:**
- Enterprise data isolated by subdomain
- Cross-enterprise access blocked
- Settings apply per-enterprise

### Isolation Implementation

| Resource | Isolation Method |
|----------|-----------------|
| Conversations | userId filter + sharing |
| Prompts | userId + teams + sharedWith |
| Artifacts | owner field + folder permissions |
| API Keys | userId (one-to-one) |
| Settings | enterpriseId |

### Cross-Tenant Protection

- Subdomain-based access control
- Enterprise membership validation
- Blocked subdomains list maintained
- Middleware enforces boundaries

---

## Consent and Privacy

### GDPR Compliance Features

PromptOwl tracks user consent for privacy compliance:

**Consent Data Captured:**
- Consent timestamp
- User's IP address
- Policy versions accepted
- Consent update history

### Policy Tracking

| Policy | Version Format |
|--------|----------------|
| Terms of Use | YYYY-MM-DD |
| Privacy Policy | YYYY-MM-DD |
| End User License Agreement | YYYY-MM-DD |
| AI Policy | YYYY-MM-DD |
| Cookie Policy | YYYY-MM-DD |
| Disclaimer | YYYY-MM-DD |

### Consent Flow

1. User registers or logs in
2. System checks for valid consent
3. If no consent or outdated policies:
   - Consent modal displayed
   - User must accept to continue
4. Consent data stored with timestamp and IP
5. Session token includes consent status

### User Data Rights

| Right | Implementation |
|-------|----------------|
| **Access** | Users can view their data |
| **Portability** | Export prompts as JSON |
| **Rectification** | Edit profile and data |
| **Erasure** | Soft delete with isDeleted flag |


---

## Session Management

### Secure Sessions

PromptOwl uses secure session management:

| Property | Value |
|----------|-------|
| **Strategy** | Token-based |
| **Duration** | 7 days |
| **Signing** | Server-side secret |
| **Storage** | HTTP-only cookies |

### Session Data

Your session token contains:
- User ID and email
- Platform role
- Enterprise memberships
- Consent status
- User preferences

### Session Security

| Measure | Purpose |
|---------|---------|
| **HTTP-only cookies** | Prevent XSS access |
| **Secure flag** | HTTPS only |
| **Expiration** | Auto-logout after 7 days |
| **Secret rotation** | Admin-controlled |

### Session Invalidation

Sessions end when:
- Token expires (7 days)
- User logs out
- Password changed (credential users)
- Admin revokes access

---

## API Security

### Authentication Methods

API requests require authentication:

**Session-Based (Web):**
- JWT token in cookies
- Automatic with browser requests

**API Key (Programmatic):**
- X-API-Key header
- Generated per-prompt
- Tied to user account

### Protected Endpoints

All API routes validate:
1. Authentication present
2. User exists and active
3. Permission for requested action
4. Rate limits not exceeded

### CORS Configuration

| Setting | Value |
|---------|-------|
| **Origin** | Configured per environment |
| **Methods** | GET, POST, PUT, DELETE |
| **Headers** | Content-Type, Authorization |
| **Credentials** | Allowed |

### API Best Practices

**Do:**
- Use HTTPS exclusively
- Include authentication headers
- Handle errors gracefully
- Log API usage

**Don't:**
- Share API keys
- Expose keys in client code
- Ignore rate limits
- Skip error handling

---

## Enterprise Security Controls

### Feature Toggles

Enterprise admins can control security-related features:

| Feature | Security Impact |
|---------|-----------------|
| `showShareButton` | Enable/disable sharing |
| `showModelSwitcher` | Restrict model access |
| `showMemory` | Control context retention |
| `autoAddUsersToTeam` | Automatic team membership |

### Enterprise Settings

| Setting | Description |
|---------|-------------|
| **Active Status** | Enable/disable enterprise |
| **Default Prompt** | Restrict to specific prompt |
| **Feature Flags** | Control available features |
| **Team Auto-Add** | Automatic membership |

### Subdomain Security

- Each enterprise has unique subdomain
- Users restricted to their subdomain
- Cross-subdomain access blocked
- Admin override capabilities

### Team Management

| Control | Description |
|---------|-------------|
| **Member Roles** | Assign appropriate access |
| **Team Deletion** | Remove all team access |
| **Role Changes** | Audit trail of changes |
| **Email Verification** | Required for team invites |

---

## Security Best Practices

### For Users

**Account Security:**
- Use strong, unique passwords
- Enable OAuth when possible
- Review account activity
- Report suspicious access

**API Key Management:**
- Rotate keys periodically
- Don't share keys
- Use separate keys per environment
- Monitor usage in provider dashboards

**Data Handling:**
- Don't input sensitive data in prompts
- Review shared resource access
- Use appropriate team roles
- Clear unused conversations

### For Administrators

**Enterprise Configuration:**
- Review feature toggles regularly
- Audit user access periodically
- Monitor for unusual activity
- Keep enterprise settings current

**Team Management:**
- Assign minimum necessary permissions
- Remove departed employees promptly
- Review team memberships quarterly
- Document access decisions

**Security Monitoring:**
- Review sharing activity
- Monitor API usage
- Check for deprecated models
- Validate consent compliance

### Security Checklist

**Account Level:**
- [ ] Strong password or OAuth
- [ ] Email verified
- [ ] Consent given
- [ ] API keys encrypted

**Enterprise Level:**
- [ ] Feature toggles reviewed
- [ ] Teams properly configured
- [ ] User roles appropriate
- [ ] Sharing settings correct

---

## Compliance Considerations

### Built-In Compliance Features

| Feature | Compliance Purpose |
|---------|-------------------|
| Consent tracking | GDPR Article 7 |
| IP logging | Audit trail |
| Policy versioning | Consent validity |
| Data export | Right to portability |
| Soft deletion | Data retention |

### Data Residency

- Data stored in MongoDB Atlas
- Region determined by cluster location
- Contact support for specific requirements

### Audit Capabilities

| Capability | Status |
|------------|--------|
| Consent logs | Available |
| Login tracking | Via session timestamps |
| Data modification | Via updatedAt fields |
| Access logs | Limited |

### Compliance Responsibilities

**PromptOwl Provides:**
- Encryption infrastructure
- Access control systems
- Consent management
- Data isolation

**Customer Responsible For:**
- User training
- Policy enforcement
- Compliance documentation
- Incident response

### Industry Standards

PromptOwl implements security practices aligned with:
- OWASP Top 10 mitigations
- SOC 2 Type II principles
- ISO 27001 controls
- GDPR requirements

> **Note**: For specific compliance certifications or attestations, contact PromptOwl support.

---

## Quick Reference

### Security Features Summary

| Layer | Protection |
|-------|------------|
| **Network** | HTTPS/TLS |
| **Authentication** | OAuth + secure hashing |
| **Authorization** | RBAC |
| **Data at Rest** | Encrypted |
| **Sessions** | JWT + expiration |
| **Multi-tenancy** | Subdomain isolation |

### Contact for Security

For security concerns:
- Report vulnerabilities to security@promptowl.ai
- Contact support for compliance questions
- Review documentation for best practices

---

## Related Guides

- [Enterprise Setup and White-Label](https://nest.promptowl.ai/d/promptowl-documents/platform/enterprise/enterprise-setup-white-label)
- [Adding and Managing Users](https://nest.promptowl.ai/d/promptowl-documents/platform/enterprise/adding-managing-users)
- [API Keys and Model Configuration](https://nest.promptowl.ai/d/promptowl-documents/platform/enterprise/api-keys-model-config)