Security
Security is not a feature — it is the foundation. Every layer of Harbor Commerce is built with defense in depth.
Tenant Isolation
Every record scoped by organization ID. Complete data separation between tenants.
Role-Based Access
Granular RBAC with owner, admin, member, and viewer roles on every endpoint.
Encryption
Data encrypted at rest and in transit. TLS everywhere, PostgreSQL disk encryption.
Webhook Verification
Stripe signature verification with timestamp tolerance. Idempotent processing.
Rate Limiting
Redis-backed sliding window rate limiting on all endpoints. Strict limits on auth.
Audit Logging
Immutable audit trail for all write operations with IP, user agent, and change diffs.
API Key Security
SHA-256 hashed key storage. Keys shown once at creation. Rotation without downtime.
Incident Response
Centralized logging, monitoring, and alerting. Structured error tracking with request correlation.