Bezpieczeństwo w Wavor

Your business data deserves the same protection as a bank. We don't just tell you WHAT we protect. We show you HOW.

AES-256TLS 1.32FADSGVO/GDPRUK GDPRLGPD (BR)DPDP (IN)Serwery UE

Podstawowe bezpieczeństwo

Szyfrowanie AES-256

Sensitive fields are stored encrypted. Read without the key, they show nothing.

Centra danych UE (Hetzner DE)

Servers and customer files in Germany. Offsite backups sit encrypted outside the EU under the EU's transfer safeguards; the privacy policy names the provider.

Czas działania i infrastruktura

99.9%

Cel dostępności

Interwał kopii zapasowej

90d

Longest retention

Nerd zone

It gets technical from here. You do not need to read any of it to use Wavor safely - it is here so it can be checked.

Architektura bezpieczeństwa

How your data flows. From request to storage

KROK 1

Cloudflare Edge

Ochrona DDoS, WAF, TLS 1.3 z możliwością powrotu do 1.2. Globalna sieć anycast.

KROK 2

Cloudflare Tunnel

Origin physically unreachable. Outbound-only connection to CF, no inbound port. AOP Custom-only Trust with Wavor RSA-4096 cert.

KROK 3

Aplikacja Node.js

Weryfikacja sesji, sprawdzenie 2FA, RBAC, walidacja danych wejściowych za pomocą schematów Zod.

KROK 4

PostgreSQL + Vault

Encrypted storage with AES-256. Secrets in HashiCorp Vault.

TLS 1.3 (możliwość powrotu do 1.2)

Full Strict HTTPS on all 7 domains.

DDoS Protection

Edge protection before the server sees the request.

Gdzie są przechowywane dane?

The servers are at Hetzner in Germany (Falkenstein and Nuremberg), customer files in object storage in Germany. The data centres are guarded around the clock, with biometric access. Backups and some services such as email, SMS and AI run through providers outside the EU. Those transfers are secured under the EU's rules, and the privacy policy names every provider.

Jak są zabezpieczane klucze?

All API keys and secrets in HashiCorp Vault (KV v2, encrypted, access-controlled). Automatic rotation warning at 90/180/365 days. No plaintext secrets in code, env, or logs.

Jak działa kopia zapasowa?

Automated PostgreSQL backups every 6 hours. Kept: every one for two days, one a day up to 14 days, one a week up to 90 days. Each is decrypted again and checked after encryption, and every night the newest is restored as a test. Offsite copy at Backblaze, encrypted with our own key before it leaves the server.

Warstwy obrony

HTTP Security Headers: 14 hardened directives

CSP Level 3 (21 Direktiven)

Enforce mode. Maximum W3C standard incl. script-src-elem/-attr granular, Trusted-Types on admin subdomain, manifest/worker/media-src whitelist.

HSTS (Strict-Transport-Security)

max-age 1 year, includeSubDomains, preload enabled.

X-Frame-Options

DENY. No clickjacking via iframes.

X-Content-Type-Options

nosniff. Browsers cannot misinterpret MIME types.

Referrer-Policy

strict-origin-when-cross-origin.

Permissions-Policy

Camera, microphone, geolocation. All disabled by default.

COOP (Cross-Origin-Opener-Policy)

same-origin. Isolates browsing context.

CORP (Cross-Origin-Resource-Policy)

same-site. Resources cannot be embedded cross-origin.

Independently verifiable: Mozilla's HTTP Observatory grades the headers of wavor.io A+. A test asks Mozilla for the result again every night. https://developer.mozilla.org/en-US/observatory/analyze?host=wavor.io(developer.mozilla.org)

Bezpieczeństwo konta

2FA: TOTP / SMS / Email

Three methods for the second factor. Backup codes single-use.

Rozpoznawanie urządzeń

Instant notification on new devices via email with IP + User-Agent.

Zarządzanie sesjami

View active sessions, terminate individually or sign out all at once.

Brute-Force Protection (3 layers)

5 fails per email / 15min lockout. 10 per IP / 1h. 5 distinct emails from one IP / 24h ban.

Cloudflare Turnstile Captcha

Bot protection without click-puzzle. Script loaded with crossOrigin anonymous + no-referrer. No session leak to Cloudflare.

Bcrypt Password Hashing (cost 12)

Every guess costs computing time, which makes list attacks unaffordable. Passwords >= 12 chars, zxcvbn strength check.

Zod Input Validation

All API input validated server-side via Zod. Drizzle-Zod as single-source-of-truth with DB schema.

Rate limiting with a sliding window

A sliding window rather than fixed blocks, so a limit is not handed out afresh at the top of every minute. The counter currently lives in the individual worker process; once Redis is configured, all processes share one.

Zaawansowane kontrole

Fine-Grained RBAC (fail-closed)

Role + HTTP-method aware: GET needs view, POST/PATCH need edit, DELETE needs delete. Missing permission = 403, never bypass.

Multi-Tenant Isolation

companyId-scope on every DB query. No data leak between tenants.

Dzienniki audytu

Every mutation logged via eventLog + AuditLogger. Immutable trail with userId, companyId, action, entity.

Approval by two people

Four actions need two approvals: changes to legal values, prices and terms, and a new sub-processor. While only one person is authorised, that person decides alone. The rule takes effect once there is a second.

Polityka rotacji sekretów

Automatic warning at 90/180/365 days via secretRotation.ts.

PII Masking in Responses

Email, IBAN, phone masked for team-members without PII access. piiMasking.ts central.

Log Scrubbing

All logs are centrally scrubbed. Zero PII in logs, monitoring or debug output.

Klucze API z zakresami

Granular permissions with expiration via apiKeyAuth.ts.

Miękkie usuwanie i odzyskiwanie

28-day recovery of deleted data. deletedAt column with automatic query filter.

Data export

Full JSON export of all user data in one request. Deletion via DSAR flow (Art. 17).

Data Protection

Concrete technical measures

Field-Level Encryption (AES-256-GCM)

IBAN, tax-ID, social-security, bank-details, TOTP 2FA secrets and one-time codes (login/verification/reset): AES-256-GCM with 96-bit IV, 128-bit auth-tag. Random IV per encrypt.

Fail-closed Encryption

Without ENCRYPTION_KEY in production: server refuses to start. No plaintext fallback (GDPR Art. 32 lit. a).

Tamper Detection (GCM)

AES-GCM auth-tag detects any ciphertext tampering. Decrypt fails hard. Never silent accept.

HMAC-SHA256 Search Hashes

Encrypted fields stay searchable via deterministic HMAC. Separate key (Key-Separation per NIST SP 800-57).

Vault Key Management

ENCRYPTION_KEY + SESSION_SECRET + all API keys in HashiCorp Vault (KV v2). No plaintext in code, env, or logs.

Key Versioning for Rotation

Ciphertext format v1:iv:data:tag. Rotatable to new version without data loss.

Supply Chain Security

Protection against compromised dependencies (event-stream 2018, ua-parser-js 2021)

Dependencies as a build gate

Every build checks all dependencies against the vulnerability database. New findings block; known ones sit in a dated baseline that may only shrink.

Dependabot Alerts

GitHub Dependabot checks daily against CVE database. Automatic security PRs.

Lockfile committed

package-lock.json in repo. Prevents CI from pulling different versions than local.

SSRF protection on outbound fetches

Every address that comes from user input is checked before Wavor fetches it. Private networks are blocked, and each redirect is checked again instead of being followed blindly.

Auto Security Patches

unattended-upgrades installs operating-system security fixes automatically.

External Scripts: CORS + Referrer

Turnstile (Cloudflare) loaded with crossOrigin anonymous + referrerPolicy no-referrer. No credential leak.

Monitorowanie i obserwowalność

Error Tracking (self-hosted)

Powiadomienia o błędach w czasie rzeczywistym z informacjami o stosie.

Metryki (Prometheus + Grafana)

Opóźnienie żądania, zapytania DB, pamięć, niestandardowe metryki biznesowe.

Monitorowanie serwera

Uptime, CPU, memory, disk: 24/7 automated checks.

File-Upload Security (7-Layer Stack)

Protection against malware, polyglot attacks, SVG-XSS, path-traversal, MIME-sniffing

Layer 1: Absolute Size Gate (100 MB)

Hard cap against zip bombs + DoS. Multer + defense-in-depth.

Layer 2: Per-Type Size Gate

Images 5 MB, PDF 20 MB, video 100 MB. Type-specific limits.

Layer 3: MIME Whitelist + Blocklist

22 types allowed. HTML/JS/EXE/SH/JAR explicitly blocked (XSS vectors).

Layer 4: Filename Sanitization

Path-traversal (../), null-byte, Windows-reserved names blocked.

Layer 5: Magic-Byte Validation

File content MUST match extension + MIME. File-type library detects 'evil.exe renamed picture.jpg' attacks.

Layer 6: SVG Sanitization

DOMPurify strips embedded <script> tags from SVGs. Without sanitize, SVG upload is common XSS vector.

Layer 7: virus scan

Server-side virus scan before storage, provided the scanner is running on the server. If it is missing, that is logged rather than passed over silently.

XSS Defense in Depth (4 Layers)

Stored, reflected, DOM, supply-chain XSS. All vectors covered

Layer 1: React JSX Auto-Escape

All user inputs escaped by default. <script> tags rendered as text, never executed. Code rule: never dangerouslySetInnerHTML with user input.

Layer 2: DOMPurify Sanitizer

sanitizeProse() + sanitizeEmailPreview() clean article-HTML, email-previews + markdown. Removes <script>, <iframe>, on*-handlers, javascript:/data: URIs.

Layer 3: CSP script-src 'self'

Even if layers 1+2 fail: browser blocks foreign scripts. Whitelist only for Stripe + Turnstile captcha.

Layer 4: Trusted-Types (Admin)

require-trusted-types-for 'script' on admin.wavor.io forces every DOM manipulation through a policy. Prevents library bugs from causing DOM-XSS.