Security Policy

1. Purpose

MarineDesk AI is committed to protecting the confidentiality, integrity, and availability of customer and supplier data. This Security Policy outlines the technical and organizational measures we implement to safeguard the MarineDesk AI procurement platform.

Our security approach is defense-in-depth, implementing multiple layers of protection across authentication, authorization, data transmission, and infrastructure.

2. Security Architecture

MarineDesk AI implements the following security controls:

• JWT Authentication: JSON Web Token-based session management with secure token validation
• HTTP-Only Cookies: Session cookies are HTTP-only to prevent XSS attacks
• Role-Based Access Control: Granular permissions based on user roles (Super Admin, Admin, Procurement, Owner, Manager, Supplier, Viewer)
• Supplier Secure Token Access: UUID-based tokens for supplier portal access without account creation
• Audit Logs: Comprehensive logging of all system actions for security monitoring and compliance
• Upload Security: File type validation, MIME checking, size limits, and malware scanning
• Security Headers: Implementation of X-Frame-Options, X-Content-Type-Options, CSP, and other security headers
• HTTPS: All data in transit is encrypted using TLS/HTTPS

3. Authentication

MarineDesk AI uses the following authentication mechanisms:

• JWT Session Cookies: Session tokens are stored in HTTP-only, secure cookies to prevent client-side access
• Session Expiration: Sessions expire after a configurable period of inactivity
• Logout Handling: Secure logout invalidates session tokens on both client and server
• Token Validation: All API requests validate JWT signatures and expiration
• Multi-Factor Ready: Architecture supports future MFA implementation

4. Authorization

MarineDesk AI implements role-based access control with the following roles:

Role restrictions are enforced at both the application layer and API layer. Users cannot access data or perform actions outside their assigned role permissions.

5. Supplier Portal Security

Supplier portal access is secured through:

• UUID Supplier Tokens: Cryptographically secure UUID tokens for RFQ and PO access
• Token Expiration: Tokens have configurable expiration periods
• Document Submission Controls: Suppliers can only upload documents for their assigned RFQs/POs
• Email Validation: Supplier email addresses are validated before token issuance
• No Account Creation: Suppliers do not create accounts, reducing attack surface
• Token Revocation: Tokens can be revoked by administrators if compromise is suspected

6. Upload Security

File uploads are secured through:

• Allowed File Types: Only permitted file types are accepted (.pdf, .xls, .xlsx, .xlsm, .doc, .docx, images)
• Blocked Executable Types: All executable file types are blocked (.exe, .bat, .sh, .dll, etc.)
• Size Limits: Maximum file size limits enforced to prevent denial of service
• Filename Sanitization: Uploaded filenames are sanitized to prevent path traversal attacks
• MIME Type Validation: File content is validated against declared MIME type
• Virus Scanning: Uploaded files are scanned for malware before storage
• Secure Storage: Files are stored in secure cloud storage with access controls

7. Audit Logging

MarineDesk AI maintains comprehensive audit logs for:

• Login Events: Successful and failed login attempts with IP addresses and timestamps
• Workflow Actions: RFQ creation, PO issuance, document approvals, and status changes
• Unauthorized Access Attempts: Blocked access attempts and permission denials
• Upload Rejections: Files rejected due to security violations
• Role Changes: User role assignments and modifications
• Configuration Changes: System configuration modifications

Audit logs are retained according to our data retention policy and are available for security investigations and compliance audits.

8. Infrastructure Security

Our infrastructure implements the following security measures:

• HTTPS: All data in transit is encrypted using TLS 1.2+
• Security Headers:
  • X-Frame-Options: DENY to prevent clickjacking
  • X-Content-Type-Options: nosniff to prevent MIME sniffing
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy: Restricts browser features
  • Content-Security-Policy: Restricts script sources
• Database Security: Encrypted database connections with connection pooling
• Environment Variables: Sensitive configuration stored in environment variables, not in code
• Service Role Isolation: Service role keys are isolated from application keys
• Regular Updates: Dependencies are regularly updated for security patches

9. Incident Response

MarineDesk AI follows a structured incident response process:

• Security Reporting: Security incidents can be reported to security@marinedesk.in
• Containment: Immediate containment measures to limit impact
• Investigation: Root cause analysis and impact assessment
• Customer Notification: Affected customers are notified within 72 hours of confirmed breach
• Remediation: Implementation of fixes and preventive measures
• Post-Incident Review: Lessons learned and process improvements

10. Security Contact

For security inquiries, vulnerability reports, or incident reporting, please contact: