Security

1. Data Encryption

In Transit

All data transmitted between your browser/app and our servers is encrypted using TLS 1.2 or higher. This includes API calls, webhook payloads, file uploads, and real-time WebSocket connections.

At Rest

All data stored in our databases and file storage systems is encrypted using AES-256 encryption. This covers messages, contacts, CRM records, invoices, inventory data, knowledge base documents, and media files.

Key Management

Encryption keys are managed through secure key management infrastructure with automatic key rotation. Access to encryption keys is restricted to essential system processes only.

2. Access Control

Role-Based Access Control (RBAC)

OneDash implements a comprehensive RBAC system with module-level and action-level granularity:

• Module Permissions: Dashboard, Contacts, Messages, CRM, Inventory, Invoicing, Reports, Settings, Users, Roles, Billing, and AI.
• Action Permissions: View, Create, Edit, Delete, Export, and Manage, configurable per module.
• Custom Roles: Create unlimited custom roles with tailored permission sets.
• Team Management: Invite members, assign roles, and manage access centrally.

Authentication

• Secure password hashing with industry-standard algorithms.
• JWT-based session management with token expiration and refresh.
• Session management with automatic timeout.
• Customer Portal authentication isolated from main platform.

3. Infrastructure Security

Hosting & Data Centre

• Primary Location: Johannesburg, South Africa, ensuring data sovereignty.
• Disaster Recovery: Automated backup and failover capabilities.
• Uptime: 99.9% uptime SLA for Enterprise customers.
• DDoS Protection: Traffic filtering and rate limiting through Cloudflare.

File Storage

• Documents, media, and generated PDFs stored on Cloudflare R2 with encryption at rest.
• Access controlled through signed URLs with expiration.
• Separate storage buckets per data type (documents, media, exports).

Network Security

• Firewall rules restricting access to essential ports and services.
• API rate limiting to prevent abuse and brute-force attacks.
• Input validation and sanitisation on all endpoints.
• Protection against OWASP Top 10 vulnerabilities.

4. Audit & Monitoring

Audit Trails

Every significant action on the platform is logged with full context:

• User identity, timestamp, and IP address.
• Action performed (create, update, delete, export, login, etc.).
• Affected entity and module.
• Before/after snapshots for data modifications.

Audit logs are retained for 2 years and are accessible to account administrators.

System Monitoring

• Real-time monitoring of application health and performance.
• Automated alerting for anomalous access patterns.
• Error tracking and incident logging.
• Regular log review and analysis.

5. Data Isolation

Multi-Tenant Architecture

OneDash operates a multi-tenant architecture with strict data isolation:

• Each account's data is logically isolated, queries are scoped to the authenticated tenant.
• AI training data (knowledge base, embeddings) is isolated per account and never shared.
• API keys and service credentials are account-specific.
• File storage is namespaced per account.

6. Application Security

• Input Validation: All user inputs are validated and sanitised to prevent SQL injection, XSS, and other injection attacks.
• CSRF Protection: Cross-site request forgery tokens on all state-changing operations.
• Content Security: Strict Content Security Policy headers to prevent code injection.
• Dependency Management: Regular scanning and updating of third-party libraries.
• Secure File Upload: File type validation, size limits, and malware scanning for uploaded documents.
• API Security: Token-based authentication, rate limiting, and request validation on all API endpoints.

7. Incident Response

We maintain a formal incident response plan that includes:

• Detection: Automated monitoring and alerting for security events.
• Containment: Immediate isolation of affected systems to prevent spread.
• Investigation: Root cause analysis and impact assessment.
• Notification: Timely notification to affected customers and regulatory authorities (Information Regulator) as required by POPIA.
• Recovery: Restoration of affected services and data from backups.
• Post-Incident Review: Lessons learned and implementation of preventive measures.

8. Compliance

9. Responsible Disclosure

We welcome responsible security researchers to report vulnerabilities. If you discover a security issue, please report it to:

• Email: [email protected]

We commit to acknowledging reports within 48 hours and providing updates on remediation progress. We will not take legal action against researchers who act in good faith.

10. Contact

For security-related questions or to report a concern:

• Security Team: [email protected]
• Privacy Officer: [email protected]
• General: [email protected]