Skip to main content

🔒 Security Principles

Welcome, Inner Journey protectors! 🌟 This document outlines the core security principles for the Inner Journey platform. Our commitment is to ensure user data is safe and that our platform strictly complies with GDPR. We prioritize trust and privacy, and your vigilance helps make this possible!

🛡️ Security Overview​

We implement security across multiple layers, focusing on robust authentication, data protection, compliance, and access control.

Authentication​

Secure user access is paramount.

  • Firebase Authentication: Users authenticate using Firebase Authentication (specifically email/password method), providing a secure gateway to the platform.
  • API Security: All protected API endpoints (e.g., /onboarding/chat, /gemini/getActivation) require an Authorization: Bearer <id_token> header. This token is rigorously verified by the backend using the Firebase Admin SDK before granting access.

Data Protection​

Protecting user data both at rest and in transit is critical.

  • Encryption: Google Firestore automatically encrypts all data at rest. Furthermore, all communication between the client, backend, and external services uses HTTPS (TLS) to encrypt data in transit.
  • Secrets Management: Sensitive API keys and credentials (like those for Firebase, Google Gemini, and Sinch) are securely stored using Google Cloud Secret Manager. These secrets are accessed securely only during deployment and runtime by authorized services.

GDPR Compliance​

We adhere to GDPR regulations to protect user rights.

  • Consent Management: User consents (e.g., for data processing, communication) are meticulously recorded in the consents Firestore collection. Each record includes timestamps and policy versions for full traceability and auditability.
  • Data Deletion Requests: Users have the right to request the deletion of their personal data. Upon request, their information is purged from relevant Firestore collections, including users, user_activations, live_sessions, and consents.
  • Data Retention Policy: Audio and video logs stored within the user_activations collection are automatically deleted after 90 days, unless the user explicitly renews their consent for longer retention.

Access Control​

Ensuring users and internal roles only access appropriate data.

  • Firestore Security Rules: Granular rules are implemented in Firestore to enforce data access policies. These rules ensure that standard users can only access their own data.
  • Role-Based Access Control (RBAC): Designated roles (e.g., "Coach") have specific, elevated permissions. For instance, coaches can access assigned user data necessary for managing programs and activations, strictly enforced through Firestore security rules.

For more in-depth details on specific security implementations, please refer to the source code, such as the authentication service logic available on GitHub: backend/services/auth_service.py, and the documentation regarding the Database Structure.