Sigurtà fil-Wavor Id-dejta tan-negozju tiegħek tistħoqqlu l-istess protezzjoni bħal bank. Aħna ma ngħidulekx X'naħdmu. Aħna nurulek KIF.
AES-256 Encryption
Qasam sensittivi huma maħżuna imħarsa. Aqra mingħajr il-keys, ma juru xejn.
Data Centers tal-UE (Hetzner DE)
Servers and customer files in Germany. Offsite backups sit encrypted outside the EU under the EU's transfer safeguards; the privacy policy names the provider.
Nerd zone It gets technical from here. You do not need to read any of it to use Wavor safely - it is here so it can be checked.
Architettura tas-Sigurtà Kif il-data tiegħek tiċċirkola. Minn talba sa ħażna
PASS 1
Cloudflare Edge
Protezzjoni DDoS, WAF, TLS 1.3 bil-fall back 1.2. Netwerk globali ta' anycast.
PASS 2
Cloudflare Tunnel
Oriġini fiżikament mhux aċċessibbli. Konnessjoni biss lejn CF, l-ebda port inbound. AOP Custom-only Trust ma' Wavor RSA-4096 ċertifikat.
PASS 3
Applikazzjoni Node.js
Validazzjoni tal-session, kontroll 2FA, RBAC, validazzjoni tal-input permezz ta' Zod schemas.
PASS 4
PostgreSQL + Vault
Encrypted storage with AES-256. Secrets in HashiCorp Vault.
TLS 1.3 (1.2 Fallback)
HTTPS strett sħiħ fuq l-7 domini kollha.
Protezzjoni DDoS
Protezzjoni tal-edge qabel ma s-server jara t-talba.
Fejn hija maħżuna d-data?
The servers are at Hetzner in Germany (Falkenstein and Nuremberg), customer files in object storage in Germany. The data centres are guarded around the clock, with biometric access. Backups and some services such as email, SMS and AI run through providers outside the EU. Those transfers are secured under the EU's rules, and the privacy policy names every provider.
Kif huma sikuri l-keys?
L-API keys kollha u s-sigrieti fil-HashiCorp Vault (KV v2, imħassra, kontrollata aċċess). Twissija awtomatika ta' rotazzjoni f'90/180/365 jum. L-ebda sigriet plaintext fil-kodiċi, env, jew logs.
Kif jaħdem il-backup?
Automated PostgreSQL backups every 6 hours. Kept: every one for two days, one a day up to 14 days, one a week up to 90 days. Each is decrypted again and checked after encryption, and every night the newest is restored as a test. Offsite copy at Backblaze, encrypted with our own key before it leaves the server.
Strati ta' Difesa HTTP Security Headers: 14 direttivi imsaħħaħ
CSP Level 3 (21 Direktiven)
Mod infurzat. Standard massimu W3C inklużi script-src-elem/-attr granulari, Trusted-Types fuq subdomini tal-amministratur, whitelist manifest/worker/media-src.
HSTS (Strict-Transport-Security)
max-age 1 sena, includeSubDomains, preload attivat.
X-Frame-Options
DENY. L-ebda clickjacking permezz ta' iframes.
X-Content-Type-Options
nosniff. Il-browsers ma jistgħux jinterpretaw ħażin it-tipi MIME.
Referrer-Policy
strict-origin-when-cross-origin.
Permissions-Policy
Kamera, mikrofonu, geolokazzjoni. Kollha disattivati b'definizzjoni.
COOP (Cross-Origin-Opener-Policy)
same-origin. Isolek il-kuntest tal-browsing.
CORP (Cross-Origin-Resource-Policy)
same-site. Ir-riżorsi ma jistgħux jiġu embeddati cross-origin.
Independently verifiable: Mozilla's HTTP Observatory grades the headers of wavor.io A+. A test asks Mozilla for the result again every night. https://developer.mozilla.org/en-US/observatory/analyze?host=wavor.io(developer.mozilla.org)
2FA: TOTP / SMS / Email
Tliet metodi għall-fattur sekondarju. Kodiċi ta' backup ta' użu uniku.
Rikonoxximent tal-Apparat
Notifika immedjata fuq apparati ġodda permezz ta' email bil-IP + User-Agent.
Ġestjoni tas-Sessjoni
Ara sessjonijiet attivi, ittemm individwalment jew iffirmat barra kollha f'waqfa.
Protezzjoni kontra Brute-Force (3 strati)
5 fallimenti kull email / 15min lockout. 10 kull IP / 1h. 5 emails distinti minn IP wieħed / 24h ban.
Cloudflare Turnstile Captcha
Protezzjoni kontra bot mingħajr click-puzzle. Skript imlaħaq bil-crossOrigin anonimu + no-referrer. L-ebda tixrid tal-session lejn Cloudflare.
Bcrypt Password Hashing (kost 12)
Kull gess jiswa ħin ta' computazzjoni, li jagħmel attakki tal-lista inaffordabbli. Passwords >= 12 karattri, kontroll ta' saħħa zxcvbn.
Zod Input Validation
Kull input API validat server-side permezz ta' Zod. Drizzle-Zod bħala s-sors uniku tal-verità ma' DB schema.
Rate limiting with a sliding window
A sliding window rather than fixed blocks, so a limit is not handed out afresh at the top of every minute. The counter currently lives in the individual worker process; once Redis is configured, all processes share one.
RBAC Granulari (fail-closed)
Ruħ + konoxxenza tal-metodu HTTP: GET jeħtieġ viżjoni, POST/PATCH jeħtieġ edit, DELETE jeħtieġ delete. Permess nieqes = 403, qatt ma jgħaddi.
Isolament Multi-Tenant
companyId-scope fuq kull query DB. L-ebda tixrid tad-data bejn il-tenants.
Logs ta' Audit
Kull mutazzjoni maħżuna permezz ta' eventLog + AuditLogger. Trail immutabbli bil-userId, companyId, azzjoni, entità.
Approval by two people
Four actions need two approvals: changes to legal values, prices and terms, and a new sub-processor. While only one person is authorised, that person decides alone. The rule takes effect once there is a second.
Politika ta' Rotazzjoni tas-Sigrieti
Twissija awtomatika f'90/180/365 jum permezz ta' secretRotation.ts.
Masking tal-PII fil-Ħlasijiet
Email, IBAN, telefon maskjati għal membri tat-tim mingħajr aċċess għal PII. piiMasking.ts ċentrali.
Log Scrubbing
Kull log huwa ċentralment imscrubjat. Zero PII fil-logs, monitoraġġ jew output ta' debug.
API Keys bil-Scopes
Permessi granulari bil-scadenza permezz ta' apiKeyAuth.ts.
Soft-Delete & Rekuperazzjoni
Rekuperazzjoni ta' data imħassra għal 28 jum. Kolonna deletedAt bil-filtru awtomatiku tal-query.
Data export
Esportazzjoni sħiħa JSON ta' kull dejta tal-utent f'waħda talba. Tneħħija permezz ta' fluss DSAR (Art. 17).
Protezzjoni tad-Data Concrete technical measures
Encryption fil-Livell tal-Qasam (AES-256-GCM)
IBAN, tax-ID, soċjali, dettalji tal-bank, sigrieti TOTP 2FA u kodiċi ta' darba (login/verifika/reset): AES-256-GCM bil-96-bit IV, 128-bit auth-tag. IV każwali għal kull encrypt.
Encryption Fail-closed
Bla ENCRYPTION_KEY fil-produzzjoni: is-server jirrifjuta li jibda. L-ebda fallback plaintext (GDPR Art. 32 lit. a).
Detezzjoni ta' Tampering (GCM)
AES-GCM auth-tag jidentifika kwalunkwe tħaddim ta' ciphertext. Decrypt jonqos b'mod qawwi. Qatt ma aċċetta bil-qalb.
HMAC-SHA256 Search Hashes
Qasam imħassra jibqa' searchable permezz ta' HMAC deterministiku. Key separata (Key-Separation per NIST SP 800-57).
Ġestjoni tal-Key tal-Vault
ENCRYPTION_KEY + SESSION_SECRET + l-API keys kollha fil-HashiCorp Vault (KV v2). L-ebda plaintext fil-kodiċi, env, jew logs.
Versioning tal-Key għal Rotazzjoni
Format ta' ciphertext v1:iv:data:tag. Rotatable għal verżjoni ġdida mingħajr telf ta' dejta.
Sigurtà tal-Katina ta' Provvista Protezzjoni kontra dipendenzi kompromessi (event-stream 2018, ua-parser-js 2021)
Dependencies as a build gate
Every build checks all dependencies against the vulnerability database. New findings block; known ones sit in a dated baseline that may only shrink.
Avviżi ta' Dependabot
GitHub Dependabot jivverifika kuljum kontra d-database CVE. PRs ta' sikurezza awtomatiċi.
Lockfile impenjat
package-lock.json fil-repo. Ippreventi CI milli jġib verżjonijiet differenti minn lokali.
SSRF protection on outbound fetches
Every address that comes from user input is checked before Wavor fetches it. Private networks are blocked, and each redirect is checked again instead of being followed blindly.
Patches ta' Sigurtà Awtomatiċi
unattended-upgrades installs operating-system security fixes automatically.
Skripts Esterni: CORS + Referrer
Turnstile (Cloudflare) imlaħaq bil-crossOrigin anonimu + referrerPolicy no-referrer. L-ebda tixrid tal-kredenzjali.
Monitoraġġ & Osservabilità Tracking tal-Istejjer (self-hosted)
Avviżi ta' żball f'ħin reali bil-traces tal-istack.
Metrics (Prometheus + Grafana)
Latency tal-talba, DB queries, memorja, metriċi tan-negozju custom.
Monitoraġġ tas-Server
Uptime, CPU, memorja, disk: kontrolli awtomatiċi 24/7.
Sigurtà tal-Fajl-Upload (7-Layer Stack) Protezzjoni kontra malware, attakki polyglot, SVG-XSS, path-traversal, MIME-sniffing
Layer 1: Gate ta' Daqs Assolut (100 MB)
Hard cap kontra zip bombs + DoS. Multer + difiża fil-fond.
Layer 2: Gate ta' Daqs Per-Tip
Immaġini 5 MB, PDF 20 MB, video 100 MB. Limiti speċifiċi għall-tip.
Layer 3: MIME Whitelist + Blocklist
22 tipi permessi. HTML/JS/EXE/SH/JAR esplicitament imblukkati (XSS vectors).
Layer 4: Sanitizzazzjoni tal-Isem tal-Fajl
Path-traversal (../), null-byte, ismijiet riservati ta' Windows blokkati.
Layer 5: Validazzjoni tal-Magic-Byte
Il-kontenut tal-fajl GĦANDU jikkorrispondi mal-estensjoni + MIME. Il-librerija tal-fajl-tip tidentifika attakki 'evil.exe renamed picture.jpg'.
Layer 6: Sanitizzazzjoni SVG
DOMPurify jitneħħi t-tags <script> imdaħħla minn SVGs. Mingħajr sanitization, l-upload ta' SVG huwa vettur komuni ta' XSS.
Layer 7: virus scan
Server-side virus scan before storage, provided the scanner is running on the server. If it is missing, that is logged rather than passed over silently.
Difiża XSS fil-Fond (4 Layers) XSS maħżuna, riflessa, DOM, supply-chain. Kull vettur kopert
Layer 1: React JSX Auto-Escape
Il-inputs kollha tal-utent huma escapati b'default. <script> tags jiġu rnderati bħala test, qatt ma jsiru eżegwiti. Regola tal-kodiċi: qatt ma dangerousSetInnerHTML bil-input tal-utent.
Layer 2: DOMPurify Sanitizer
sanitizeProse() + sanitizeEmailPreview() tnaddaf l-artiklu-HTML, email-previews + markdown. Tneħħi <script>, <iframe>, on*-handlers, javascript:/data: URIs.
Layer 3: CSP script-src 'self'
Anki jekk il-livelli 1+2 jonqsu: il-browser jiblokka skripts barranin. Whitelist biss għal Stripe + Turnstile captcha.
Layer 4: Trusted-Types (Admin)
require-trusted-types-for 'script' fuq admin.wavor.io jforza kull manipulazzjoni tal-DOM permezz ta' politika. Ippreventi li l-bugs tal-librerija jikkawżaw DOM-XSS.
Roadmap ta' Ċertifikazzjoni Aħna trasparenti: Aħna qed nibnu u m'għandniex ċertifikazzjonijiet formali għad-dar. Iżda diġà nimplimentaw il-linji gwida u qed naħdmu attivament lejnhom.
DSGVO / GDPR (EU)
Implimentat UK GDPR (Data Protection Act 2018)
Implimentat LGPD (Brasilien)
Implimentat DPDP Act 2023 (Indien)
Implimentat AVG (Niederlande)
Implimentat FADP (Schweiz)
Implimentat ePrivacy (Cookie-Consent)
Implimentat DSA (Digital Services Act)
Implimentat
ISO 27017 + 27018 (Cloud)
Pjanat
ISO 27701 (Privacy)
Pjanat
ISO 42001 (AI Management)
Pjanat Aħna wkoll align ma' l-Att AI tal-EU, NIS2 u GoBD (kontabilità Ġermaniża). Dawn huma regolamenti, mhux ċertifikazzjonijiet.
We only work with vetted, certified providers. Each one has been checked for security and data protection.
Hetzner Online GmbH ISO 27001, data centre in Germany
Cloudflare, Inc. SOC 2, ISO 27001
Stripe Payments Europe Ltd. PCI DSS Level 1
Amazon Web Services, Inc. (AWS) ISO 27001, SOC 2
OVH SAS (OVHcloud) ISO 27001, stored in Germany. Encryption at rest by the provider (AES-256).
Backblaze, Inc. SOC 2. Bucket with Object Lock (compliance mode): once written, a backup cannot be deleted before its retention date.
Twilio, Inc. SOC 2, ISO 27001
Mistral AI SAS SOC 2 Type II, ISO 27001/27701, data in the EU
OpenAI LLC SOC 2 Type II, no training on API inputs
OpenProvider B.V. EU-based (Netherlands)
Rapporta Problema ta' Sigurtà Sib vulnerabbiltà? Rapportha b'mod kunfidenzjali lit-tim tagħna. Aħna nieħdu kull rapport bis-serjetà u se nerġgħu nikkuntattjawkom malajr kemm jista' jkun.
Rapporta 