Security Overview

Security architecture, best practices, and compliance information for the soft.house platform.

Security Architecture

soft.house is built with security as a foundational requirement, not an afterthought. Our architecture implements defense-in-depth across all layers.

Protocol Security

ProtocolSecurity MechanismPurpose
AP2ECDSA SignaturesMandate authentication
AP2Nonce ValidationReplay attack prevention
ACPHMAC VerificationWebhook integrity
ACPBearer Token ScopingAccess control
TAPEd25519 PKIAgent identity verification

Infrastructure Security

  • Cloudflare Workers — Edge-deployed, DDoS protection included
  • Supabase RLS — Row-Level Security on all database tables
  • KV-based Rate Limiting — Per-user and per-IP limits
  • HTTPS Only — All traffic encrypted with TLS 1.3
  • HSTS — Strict Transport Security with preload

Authentication Security

API Keys

  • Keys are hashed before storage (never stored in plaintext)
  • Test and live keys are isolated environments
  • Keys can be scoped to specific permissions
  • Automatic key rotation reminders at 90 days

Session Security

  • httpOnly cookies (not accessible via JavaScript)
  • Secure flag (HTTPS only)
  • SameSite=Lax (CSRF protection)
  • 24-hour session expiration

Data Protection

  • All data encrypted at rest (AES-256)
  • All data encrypted in transit (TLS 1.3)
  • Database backups encrypted
  • PII access logged and audited

Rate Limiting

Endpoint CategoryLimitWindow
General API100 requestsPer minute, per user
Authentication5 attemptsPer 15 minutes, per IP
Mandate Creation10 mandatesPer hour, per user
Webhook Delivery50 retriesPer 24 hours, per endpoint

Security Headers

All responses include security headers:

X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; ...

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly:

  • Email: security@soft.house
  • Do not disclose publicly until patched
  • We aim to respond within 24 hours
  • We do not pursue legal action for good-faith reports
Go SDK Compliance