1"use strict";(self.webpackChunkmy_website=self.webpackChunkmy_website||[]).push([["9116"],{1353(e,i,n){n.r(i),n.d(i,{metadata:()=>t,default:()=>u,frontMatter:()=>l,contentTitle:()=>o,toc:()=>d,assets:()=>a});var t=JSON.parse('{"id":"security/data-security","title":"Is My Data Secure?","description":"Witzo provides application-level security protections, while overall security depends on your deployment configuration.","source":"@site/docs/security/data-security.mdx","sourceDirName":"security","slug":"/security/data-security","permalink":"/docs/security/data-security","draft":false,"unlisted":false,"tags":[],"version":"current","sidebarPosition":1,"frontMatter":{"sidebar_label":"Data Security","sidebar_position":1}}'),r=n(1325),s=n(9705);let l={sidebar_label:"Data Security",sidebar_position:1},o="Is My Data Secure?",a={},d=[{value:"Overview",id:"overview",level:2},{value:"Application-Level Security Controls",id:"application-level-security-controls",level:2},{value:"Helmet security headers",id:"helmet-security-headers",level:3},{value:"CSRF protection",id:"csrf-protection",level:3},{value:"CORS protection",id:"cors-protection",level:3},{value:"Input sanitization",id:"input-sanitization",level:3},{value:"Request validation",id:"request-validation",level:3},{value:"Production Hardening Considerations",id:"production-hardening-considerations",level:2},{value:"Related Articles",id:"related-articles",level:2}];function c(e){let i={a:"a",admonition:"admonition",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(i.header,{children:(0,r.jsx)(i.h1,{id:"is-my-data-secure",children:"Is My Data Secure?"})}),"\n",(0,r.jsx)(i.p,{children:"Witzo provides application-level security protections, while overall security depends on your deployment configuration."}),"\n",(0,r.jsx)(i.hr,{}),"\n",(0,r.jsx)(i.h2,{id:"overview",children:"Overview"}),"\n",(0,r.jsx)(i.p,{children:"Witzo is built with multiple backend protections to secure data, prevent abuse, and reduce common web vulnerabilities. These protections work at the application level."}),"\n",(0,r.jsx)(i.p,{children:"Infrastructure-level security depends on how and where you deploy the platform."}),"\n",(0,r.jsx)(i.h2,{id:"application-level-security-controls",children:"Application-Level Security Controls"}),"\n",(0,r.jsx)(i.h3,{id:"helmet-security-headers",children:"Helmet security headers"}),"\n",(0,r.jsx)(i.p,{children:"Witzo uses helmet middleware to set secure HTTP headers, including:"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Content Security Policy (CSP)"}),"\n",(0,r.jsx)(i.li,{children:"X-Frame-Options"}),"\n",(0,r.jsx)(i.li,{children:"X-Content-Type-Options"}),"\n",(0,r.jsx)(i.li,{children:"Referrer-Policy"}),"\n",(0,r.jsx)(i.li,{children:"Strict-Transport-Security (when HTTPS is enabled)"}),"\n"]}),"\n",(0,r.jsx)(i.p,{children:"These headers reduce clickjacking, MIME sniffing, and injection risks."}),"\n",(0,r.jsx)(i.h3,{id:"csrf-protection",children:"CSRF protection"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Mutating protected routes (such as dashboard updates) use CSRF verification."}),"\n",(0,r.jsx)(i.li,{children:"This prevents unauthorized third-party requests from executing actions on behalf of logged-in users."}),"\n",(0,r.jsx)(i.li,{children:"Public chat endpoints are designed separately and do not rely on session cookies."}),"\n"]}),"\n",(0,r.jsx)(i.h3,{id:"cors-protection",children:"CORS protection"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Witzo enforces CORS origin checks."}),"\n",(0,r.jsx)(i.li,{children:"Only allowed domains can interact with protected endpoints."}),"\n",(0,r.jsx)(i.li,{children:"This prevents external domains from misusing API routes."}),"\n"]}),"\n",(0,r.jsx)(i.h3,{id:"input-sanitization",children:"Input sanitization"}),"\n",(0,r.jsx)(i.p,{children:"All incoming data is sanitized before processing. This reduces the risk of:"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Script injection"}),"\n",(0,r.jsx)(i.li,{children:"Malformed payload abuse"}
1),"\n",(0,r.jsx)(i.li,{children:"Database manipulation attempts"}),"\n"]}),"\n",(0,r.jsx)(i.h3,{id:"request-validation",children:"Request validation"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Request validation middleware ensures required fields are present and correctly formatted."}),"\n",(0,r.jsx)(i.li,{children:"Invalid or unexpected data is rejected before reaching business logic."}),"\n"]}),"\n",(0,r.jsx)(i.h2,{id:"production-hardening-considerations",children:"Production Hardening Considerations"}),"\n",(0,r.jsx)(i.p,{children:"Application security alone is not enough. Production deployment should also include:"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"HTTPS with valid TLS certificates"}),"\n",(0,r.jsx)(i.li,{children:"Firewall rules"}),"\n",(0,r.jsx)(i.li,{children:"Database access restrictions"}),"\n",(0,r.jsx)(i.li,{children:"Environment variable protection"}),"\n",(0,r.jsx)(i.li,{children:"Secure Redis configuration"}),"\n",(0,r.jsx)(i.li,{children:"Regular dependency updates"}),"\n"]}),"\n",(0,r.jsx)(i.admonition,{type:"note",children:(0,r.jsx)(i.p,{children:"Security posture depends on infrastructure setup."})}),"\n",(0,r.jsx)(i.admonition,{title:"Important Notes or Limitations",type:"warning",children:(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:"Encryption in transit depends on HTTPS configuration."}),"\n",(0,r.jsx)(i.li,{children:"Encryption at rest depends on your database and hosting provider."}),"\n",(0,r.jsx)(i.li,{children:"Security headers are active, but CSP tuning may require deployment-specific adjustments."}),"\n"]})}),"\n",(0,r.jsx)(i.h2,{id:"related-articles",children:"Related Articles"}),"\n",(0,r.jsxs)(i.ul,{children:["\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.a,{href:"./data-storage",children:"Data Storage and Hosting"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.a,{href:"./data-deletion",children:"Data Deletion and GDPR Considerations"})}),"\n",(0,r.jsx)(i.li,{children:(0,r.jsx)(i.a,{href:"../installation/troubleshooting",children:"Embedding and Installation Issues"})}),"\n"]})]})}function u(e={}){let{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,r.jsx)(i,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},9705(e,i,n){n.d(i,{R:()=>l,x:()=>o});var t=n(489);let r={},s=t.createContext(r);function l(e){let i=t.useContext(s);return t.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function o(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),t.createElement(s.Provider,{value:i},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.