Security & Data Protection Disclosures

Documents technical access controls, API key security, SMTP credential encryption, and logging.

1. Technical Security Controls

Histeria employs modern security controls to protect platform infrastructure and user data:

Authentication: JWT bearer authentication with bcrypt password hashing and server-verified Google OAuth ID tokens.
Organization Isolation: Strict multi-tenant isolation enforcing organization context verification headers (x-organization-id) on all tenant resources.
API Key Governance: API keys are securely hashed using HMAC SHA-256; raw secret keys are displayed only once upon creation.
Encrypted Credentials: SMTP credentials provided by customers are encrypted at rest prior to database storage.
Rate Limiting & Rate Throttling: Authentication and email sending endpoints are rate-limited to protect against brute-force attacks and abuse.