Security at BuildStax

Read the full SECURITY.md for the threat model, controls inventory, and SOC 2 roadmap. The highlights:

Tenant isolation

Postgres row-level security enforced on every tenant table (FORCE ROW LEVEL SECURITY). No application-layer bypass.

Authentication

TOTP MFA + backup codes for every account; WebAuthn passkeys for phishing-resistant sign-in. Platform admins must use MFA.

Passwords

NIST SP 800-63B policy: 12+ characters, checked against known-breach lists (HIBP) at signup and reset.

Payments

PCI-DSS SAQ-A. Card data is tokenized by Stripe Elements and never touches BuildStax servers.

Secrets

Third-party keys (Stripe, Anthropic) are envelope-encrypted with AES-256-GCM before storage.

Browser hardening

Nonce-based Content Security Policy with strict-dynamic, HSTS preload, and CSP violation reporting.

Audit

Append-only audit log for every mutation, break-glass access with dual approval and time-boxing, per-tenant security-events console.

AI features

Prompt-injection defenses on every model call; Anthropic contractually prohibited from training on your data; per-tenant token budgets.