Account and data security

Authentication#

Clerk is the only application identity provider. Protected API calls require a bearer token. The API verifies the token against Clerk’s JWKS endpoint, checks the issuer and session state, and places the verified organization and user identifiers on the request.

Development can use an x-org-id fallback only when ALLOW_INSECURE_DEV_AUTH=true. Production configuration force-disables that bypass when ENV is prod or production.

Tenant isolation#

Organization-owned database queries filter by the verified org_id. This boundary covers integrations, runs, actions, approvals, settings, metrics, and billing data.

Authorization#

The API resolves each authenticated user to an application role and checks a route-specific permission before protected handlers run. Clerk organization administrators retain full access. Operational roles and delegated permissions are stored per organization; ordinary members are read-only by default. Billing and role management remain administrator-only and cannot be delegated.

Authorization failures return HTTP 403. Unmapped future write routes fail closed to administrator-only access.

Credential storage#

Board tokens are encrypted before storage and are not returned in API responses. Use a managed secret store for deployment variables such as Clerk, Stripe, database, and encryption keys.

Request controls#

The API implements a process-local sliding-window limiter. Defaults are:

• 200 read requests per minute.
• 60 write requests per minute.

Limits can be changed with deployment environment variables. Health checks, Stripe webhooks, OPTIONS, and HEAD follow documented exemptions.

Because the limiter is process-local, it is not a guaranteed global quota across multiple instances. Treat the values as application protection, not a contractual public API limit.

Browser security headers#

The Next.js configuration sets a Content Security Policy, frame denial, MIME-sniff protection, a strict-origin referrer policy, and a restrictive permissions policy for camera, microphone, and location.

User-controlled security features#

Password reset, MFA, invitation policy, session management, and identity-provider choices are controlled by the deployed Clerk configuration. Their current production behavior needs verification before customer instructions are published.

For legal data-handling statements, use the application’s Privacy page. Its contact and legal language still require product-owner and counsel review.