Security Architecture

Last updated April 2026

Your business data is the most sensitive asset you have. ABE is built from the ground up with tenant isolation, encryption, and auditability as core architecture — not afterthoughts. This document describes exactly how we protect your data.

Data Isolation

ABE is a multi-tenant platform. All tenants share a single PostgreSQL database, with isolation enforced at the row level by the ORM framework. Tenant-owned models include a Tenantable concern that applies an automatic database scope filtering by the authenticated tenant on every query.

This means SELECT, UPDATE, and DELETE operations are automatically scoped. A user authenticated under Tenant A cannot query, modify, or delete Tenant B's records. The scope is enforced below the controller layer — individual endpoints do not need to remember to filter by tenant.

Row-level isolation via database default scoping on every tenant-owned model
17 section-level permissions per team member (dashboard, financials, customers, billing, apps, settings, etc.)
Four access roles: Owner, Admin, Member, Viewer — with per-person overrides
Approval gates on destructive operations — deleting customers, competitors, and syncing external data require explicit confirmation

Encryption

In transit

All data encrypted via TLS. HTTPS is enforced on every endpoint in production via force_ssl. SSL termination is handled by the hosting provider's reverse proxy.

At rest

Sensitive fields are encrypted with AES-256-GCM via ActiveRecord Encryption. Encryption keys are stored as environment variables, never in the codebase.

Integration credentials (API keys, OAuth tokens, database URLs) — encrypted at rest
Phone numbers and IP addresses — encrypted at rest
Session tokens — cryptographically random, generated via SecureRandom

Authentication

ABE uses passwordless authentication exclusively. Users sign in via magic link (email) or one-time passcode (SMS/email). There are no passwords anywhere in the system — no password hashing, no password reset flows, no credential stuffing attack surface.

Magic links expire after 15 minutes. Each can only be used once.
Sessions are server-side database records, not client-side JWTs.
Default session lifetime: 30 days (configurable per tenant).
Webhook endpoints verified with HMAC-SHA256 signatures where supported by the provider.

AI Data Handling

ABE uses Anthropic's Claude models via the commercial API. Under Anthropic's commercial terms, customer data sent via the API is not used for model training and is subject to zero data retention — API inputs and outputs are not stored by Anthropic after processing.

When ABE builds context for a conversation, all data is gathered using tenant-scoped queries. One tenant's business data is never included in another tenant's AI context window.

Tenant-scoped context — financial data, customer data, memory, and team insights are all queried with explicit tenant filters
Full AI observability — every Claude API call tracked with tenant, user, model, token breakdown, and timestamp
Isolated institutional memory — decisions, patterns, and learnings are never shared across organizations
Anthropic compliance — Anthropic maintains its own security certifications for Claude's infrastructure (see trust.anthropic.com)

Infrastructure

Component	Provider	Details
Backend API	Railway	Managed containers, auto-deploy, automatic SSL
Frontend	Vercel	Edge network, auto-deploy, DDoS protection
Database	Railway PostgreSQL	Managed PostgreSQL, automated backups
Background jobs	Solid Queue	In-process job runner
File storage	Cloudflare R2	S3-compatible, encrypted at rest, zero egress
Error tracking	Sentry	PII scrubbing enabled

CI/CD Security Pipeline

Every push to the main branch triggers the following automated checks. Deploys are blocked if any check fails.

Brakeman — static security analysis, fails on any warning
Bundle Audit — dependency vulnerability scanning
RuboCop — code quality and style enforcement
RSpec — automated test suite including tenant isolation sweep
TypeScript — full type checking on every deploy
ESLint — frontend code quality

API Security

CORS

Cross-origin requests restricted to known production domains only.

Error handling

Unhandled exceptions return a generic error message. Internal details (stack traces, paths, SQL) are logged server-side only.

Security headers

X-Frame-Options: DENY, X-Content-Type-Options: nosniff, strict Referrer-Policy, Permissions-Policy.

Parameter filtering

Passwords, tokens, API keys, phone numbers, and credentials are automatically redacted from all logs.

Monitoring & Logging

Structured request logging — single-line JSON per request with method, path, status, duration, tenant, and user
Sentry error tracking — unhandled exceptions captured with tenant context, PII automatically scrubbed
Background job logging — start, complete, and failure events with duration and tenant context
AI usage tracking — every model call logged with caller, model, tokens, and tenant

Sub-Processors

The following third-party services process tenant data:

Sub-processor	Purpose
Anthropic	AI model inference (Claude)
Railway	Backend hosting and database
Vercel	Frontend hosting
Cloudflare R2	File storage (encrypted at rest)
Sentry	Error tracking (PII scrubbed)
Twilio	SMS delivery

Integration-specific data (Shopify, Slack, GitHub, Intercom, etc.) is processed only for tenants that have connected those integrations.

Compliance

Framework	Status
SOC 2 Type II	In progress — external firm engaged
GDPR	DPA available on request. Contact us.
CCPA/CPRA	Service provider terms available on request
PCI DSS	Not in scope (payments via Shopify/Stripe)
Penetration testing	Scheduled as part of SOC 2 engagement

Transparency

We believe in honesty about what we're still building:

Rate limiting is not yet implemented on API endpoints. Planned for Q2 2026.
Third-party penetration testing is scheduled as part of the SOC 2 engagement.
A formal incident response plan is being developed as part of SOC 2 preparation.
A formal vulnerability disclosure policy will be published in Q2 2026.

For security questions or to request our Data Processing Agreement, contact ehren@abe.ing

ABE