Security overview

Security at 3Dview.art is built around three commitments: tenant isolation, defence in depth, and verifiable controls.

Tenant isolation

• Every workspace is backed by its own Clerk Organization. New signups never auto-attach to an existing workspace; every user either creates a workspace or accepts an invite.
• API routes use a single tenant-scoping primitive (requireOrgMembership) and resource-specific guard functions (assertProjectInWorkspace, assertFileInWorkspace, etc.) that join through the workspace before returning rows.
• The Postgres database enforces Row-Level Security policies that refuse cross-tenant rows even if the application layer has a bug. Webhooks and cron jobs run on a separate connection with BYPASSRLS, never inside a request handler.
• R2 object keys carry the workspace ID as their first path segment, and every read goes through an authenticated proxy that issues a 60-second presigned URL after checking workspace membership. The bucket itself is private.

Authentication & authorization

• Authentication via Clerk: bcrypt-hashed passwords, optional 2FA, OAuth/SSO, account-recovery best practices.
• Three-tier roles (admin / editor / viewer) enforced on every mutating API route.
• Mention emails only deliver to recipients in the same workspace, even if a malicious comment includes other users' IDs.

Encryption

• TLS 1.2+ for every request in transit.
• Data at rest encrypted by our subprocessors (Neon, Cloudflare R2). Connection strings and API keys are stored as Vercel encrypted environment variables.

Abuse & operational hardening

• Sliding-window rate limits on auth, comments, presigned upload requests, invite, and notification polling.
• Per-workspace storage / member / project quotas to bound unintentional or malicious growth.
• Sentry error monitoring with PII scrubbing and source-mapped stack traces for fast incident response.
• Audit logs of every meaningful change in a workspace, with deduplication and retention controls.

Data lifecycle

• Account deletion anonymises personal data within 30 days while preserving authored content under "Deleted user" attribution (or removes it entirely when an admin deletes the workspace).
• Workspace deletion enqueues asynchronous removal of every R2 object under the workspace prefix.
• Audit logs and notifications are pruned by scheduled cron jobs.

Responsible disclosure

If you believe you have found a security vulnerability, please email [email protected] with details. We commit to acknowledging valid reports within 72 hours, working with you on a fix, and crediting you (with consent) on a public security page once the issue is resolved.