MRI Security & Compliance

​

Security Overview

​

Credential Security

​

Vault Encryption

• Encryption: AES-256-GCM
• Key Management: Automatic key rotation
• Access: Row-level security policies

-- Credentials are never stored in plain text
SELECT store_mri_credentials_secure(
  building_id,
  client_id,
  encrypted_client_secret,  -- AES-256 encrypted
  api_base_url,
  environment
);

​

Credential Rotation

​

Data Protection

​

Data in Transit

• All API calls use TLS 1.3 encryption
• Certificate pinning for the MRI MIX API
• No sensitive data in URL parameters

​

Data at Rest

• Database encrypted with AES-256
• Backups encrypted with separate keys
• Point-in-time recovery enabled

​

Data Minimisation

​

Access Control

​

Role-Based Access

​

Row-Level Security

-- Users can only access MRI data for their buildings
CREATE POLICY "mri_data_access" ON mri_properties
  FOR SELECT USING (
    building_id IN (
      SELECT building_id FROM building_users
      WHERE user_id = auth.uid()
    )
  );

​

Audit Logging

​

What’s Logged

• ✅ Credential storage and updates
• ✅ Credential access (every retrieval is logged)
• ✅ Credential rotation events
• ✅ API authentication attempts (success and failure)
• ✅ Failed authentication attempts with IP addresses

• ✅ Sync operations (start, complete, errors)
• ✅ All API calls (endpoint, method, HTTP status)
• ✅ Data modifications from sync
• ✅ Configuration changes
• ✅ Manual overrides and conflict resolutions
• ✅ Rate limit violations

​

Log Entry Details

{
  "id": "uuid",
  "table_name": "mri_credentials_secure",
  "record_id": "building-uuid",
  "action": "CREDENTIAL_ACCESS",
  "changed_by": "user-uuid",
  "building_id": "building-uuid",
  "ip_address": "192.168.1.1",
  "user_agent": "Mozilla/5.0...",
  "old_values": {...},
  "new_values": {...},
  "created_at": "2025-12-23T10:00:00Z"
}

​

Log Retention

​

Accessing Audit Logs

1. Navigate to Settings → Integrations → MRI
2. Click the Security tab
3. View the Audit Log section

​

Compliance

​

GDPR Compliance

​

Data Processing Agreement

1. DPA in place with MRI Software
2. Data location depends on customer’s MRI deployment
3. Data breach notification procedures agreed

​

Security Checklist

​

Weekly

• Review sync error logs
• Check for failed authentications

​

Monthly

• Audit user access permissions
• Review credential access logs
• Check sync performance metrics

​

Quarterly

• Rotate MRI credentials
• Security assessment
• Review DPA with MRI

​

Technical Security Details

​

Defense in Depth

​

Credential Security Architecture

1. Never in Plain Text - All credentials are encrypted before storage
2. Vault-Only Storage - Secrets stored in Supabase Vault, not regular database columns
3. Access Logging - Every credential retrieval is logged with user ID, IP, and timestamp
4. Building Scoped - Each building has separate credentials (no cross-contamination)
5. RLS Enforcement - Database policies prevent unauthorized access

​

HTTP Basic Auth Security

1. Storage - All MIX API credentials (Client ID, Database Name, User Name, Partner Key, Password) encrypted in Supabase Vault with AES-256-GCM
2. Retrieval - Credentials decrypted server-side only when needed for API calls
3. Usage - Base64-encoded credentials included in Authorization header over HTTPS
4. Isolation - Each building has separate credentials (no cross-contamination)
5. Rotation - Credentials can be rotated independently per building

• ✅ Credentials never exposed to frontend/browser
• ✅ All API calls over TLS 1.3 only
• ✅ No credential storage in localStorage or cookies
• ✅ Every credential access logged with user ID and IP
• ✅ Supabase Vault automatic key rotation

​

Data Encryption

• Database: AES-256 encryption
• Vault secrets: AES-256-GCM with automatic key rotation
• Backups: Encrypted with separate keys
• Point-in-time recovery: Encrypted snapshots

• TLS 1.3 for all API communications
• Certificate pinning for MRI MIX API
• No sensitive data in URL parameters
• Bearer tokens in headers only

​

Row Level Security (RLS) Policies

-- Only building directors can access credentials
CREATE POLICY "canonical_mri_credentials_all" ON mri_credentials
  FOR ALL TO authenticated
  USING (
    is_super_admin() OR
    is_building_director(building_id)
  );

-- Users can only view MRI data for their buildings
CREATE POLICY "mri_data_access" ON mri_properties
  FOR SELECT USING (
    building_id IN (
      SELECT building_id FROM building_users
      WHERE user_id = auth.uid()
    )
  );

• ✅ Enforced at database level (can’t be bypassed)
• ✅ Automatic filtering of unauthorized data
• ✅ Protection against SQL injection
• ✅ Multi-tenant data isolation

​

Incident Response

​

Immediate Actions

​

Investigation Queries

SELECT
  created_at,
  changed_by,
  action,
  ip_address,
  user_agent
FROM mri_audit_log
WHERE table_name = 'mri_credentials_secure'
AND action IN ('CREDENTIAL_ACCESS', 'CREDENTIAL_STORED', 'CREDENTIAL_ROTATED')
AND created_at > NOW() - INTERVAL '7 days'
ORDER BY created_at DESC;

SELECT
  created_at,
  action,
  error_message,
  ip_address
FROM mri_audit_log
WHERE action = 'AUTHENTICATION_FAILED'
AND created_at > NOW() - INTERVAL '24 hours'
ORDER BY created_at DESC;

​

Breach Notification

• 72-hour notification to ICO (UK GDPR requirement)
• Immediate notification to affected building directors
• Incident report provided within 7 days
• Remediation plan implemented immediately

​

Security Best Practices

​

For Building Directors

​

For Property Managers

​

Compliance Certifications

​

Current Compliance

​

Data Processing Agreement

• ✅ Purpose limitation and data minimization
• ✅ Security measures and encryption requirements
• ✅ Sub-processor agreements
• ✅ Data breach notification procedures (72 hours)
• ✅ Data subject rights support (access, erasure, portability)
• ✅ Audit rights and compliance monitoring