Security

Project isolation

Every project is an isolated workspace with its own API keys, members, settings and rate limits. Gateway requests are scoped to a single project and are authorised before any data is read. A key issued for one project can never reach another.

Credentials at rest

Sensitive values (API keys, JWT secrets, webhook signing secrets, SMTP and SMS credentials, payment gateway keys and workflow credentials) are encrypted at rest using the application key. Export archives omit secrets unless you deliberately opt in.

Access control

Roles are enforced server-side on every request: superadmin, member and manager, plus 19 granular per-project permissions. Client-facing managers are restricted to the CMS and to an explicit allowlist of endpoints; anything outside that list does not exist for them.

End-user authentication

Project end users authenticate with JWT sessions, OAuth or one-time codes over email/SMS. Passwords are hashed, one-time codes are single-use and time-boxed, and auth endpoints are rate limited independently of the rest of the gateway.

Webhooks

Inbound webhooks are signature-verified (Stripe, GitHub and generic HMAC schemes are supported) and processed idempotently, so a replayed delivery cannot double-apply. Outbound deliveries are signed and retried with backoff.

Workflow guardrails

Automation runs inside deliberate limits: the expression engine evaluates a whitelist rather than arbitrary code, code steps execute in a sandboxed runner, outbound HTTP is restricted by an egress allowlist, and credentials are injected at run time rather than stored in the graph. Every run records each step's input and output for audit.

Payments

Card data goes from your customer's browser to the payment provider directly, using tokenised or hosted checkout. It never touches the platform, which keeps deployments in the lightest PCI scope (SAQ-A). Charges are created server-side with a trusted amount, never a client-supplied price.

Data durability & portability

Content changes are versioned with restorable revision history. Whole projects export to a portable ZIP or a per-project SQL dump, so you always hold a copy you can restore elsewhere. Destructive database commands are blocked in code in production environments.

Reporting a vulnerability

We welcome reports from security researchers and will not pursue action against good-faith research that respects user privacy and avoids service disruption. Email security@api.next.com.se with steps to reproduce. We aim to acknowledge within two business days.