Data Protection

How Steadybase protects data at rest, in transit, and during processing.

Encryption

In Transit

• TLS 1.2+ enforced on all connections via nginx
• Let's Encrypt certificates with automatic renewal
• HSTS headers prevent protocol downgrade attacks
• WebSocket connections use WSS (TLS-encrypted)

At Rest

• Temporal Cloud encrypts workflow data at rest
• Memory entries stored within Temporal's durable state (encrypted by Temporal Cloud)
• Server-side configuration files have restricted permissions (600)

Secrets

Current secrets management uses environment variables in .env files with restricted file permissions:

.env file permissions: 600 (owner read/write only)
.env.backup: removed
nginx blocks: /.env, /.git, /node_modules

:::warning Environment-based secrets management is a known limitation. Migration to AWS Secrets Manager is planned for Phase 2. :::

Secrets Manager Migration Plan

The following secrets are planned for migration to AWS Secrets Manager:

Memory Isolation

Per-User Chat Isolation

Each user's Brain chat history is isolated — users can only see and access their own conversations. Chat history is scoped by the authenticated user's identity.

Memory Scope Isolation

The hierarchical memory system enforces scope boundaries:

• Organization memories are readable by all authenticated users
• Team memories are scoped to the user's team
• Worker memories are scoped to the specific worker
• Session memories exist only during the active session

Prompt Injection Defense

AI interactions include prompt injection defenses:

• System prompts include injection detection instructions
• User input is treated as untrusted data, never as system instructions
• Output is sanitized before storage in memory

Audit Logging

Security-relevant operations are logged:

• Authentication attempts (success and failure)
• API access with timestamps and user identity
• Worker actions and workflow executions
• Memory writes and deletions
• Administrative operations

:::note Audit logs are currently stored locally. Migration to CloudWatch is planned for centralized, tamper-resistant logging. :::

Data Retention