Data Protection

Overview

Moss implements multiple layers of data protection to ensure your information remains secure throughout its lifecycle.

Encryption

In Transit

All data transmitted to and from Moss is encrypted:

TLS 1.2+ - All API endpoints require HTTPS
Certificate Validation - Strict certificate verification
HSTS - HTTP Strict Transport Security headers enforced

HTTP requests are automatically redirected to HTTPS. Unencrypted connections are never accepted for API traffic.

At Rest

Data stored in Moss databases is protected:

Database Encryption - PostgreSQL with encryption at rest
Credential Hashing - All secrets stored as cryptographic hashes
Secure Key Storage - Encryption keys managed separately from data

Input Validation

All API inputs are validated before processing:

Schema Validation

Every API endpoint uses Pydantic schema validation:

class SessionRequest(BaseModel):
    user_id: str
    application_id: str
    metadata: Optional[dict] = None

    @validator('user_id')
    def validate_user_id(cls, v):
        if len(v) > 256:
            raise ValueError('user_id too long')
        return v

Validation Rules

Input Type	Validation
String fields	Length limits, format validation
IDs	UUID format verification
Enums	Allowed values only
Nested objects	Recursive validation

Rejection Behavior

Invalid requests receive clear error responses:

{
  "detail": [
    {
      "loc": ["body", "user_id"],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}

Sensitive Data Handling

Automatic Redaction

Moss automatically sanitizes sensitive data before logging: Redacted Fields:

api_key, apiKey
authorization
password
secret
token
x-api-key

How It Works:

# Before logging
{
    "user_id": "user-123",
    "api_key": "app_abc123xyz..."
}

# After sanitization
{
    "user_id": "user-123",
    "api_key": "[REDACTED]"
}

Recursive Sanitization

Redaction applies to nested objects and arrays:

{
    "config": {
        "auth": {
            "token": "[REDACTED]"  # Nested fields also sanitized
        }
    }
}

Credential Storage

API Keys

API keys are never stored in plaintext:

Stage	Protection
Generation	Cryptographically random (`secrets.token_urlsafe`)
Storage	SHA-256 hash
Comparison	Constant-time comparison (timing-safe)
Display	Shown once at creation, never retrievable

JWT Signing Keys

JWT secrets receive enhanced protection:

Stage	Protection
Generation	256-bit entropy (`secrets.token_urlsafe(32)`)
Storage	Encrypted at rest
Rotation	Support for multiple active keys
Revocation	Scheduled revocation with grace period

Password-Like Secrets

All password-equivalent credentials use:

Argon2id - Memory-hard hashing algorithm
Unique Salts - Per-credential random salts
Timing-Safe Comparison - Prevents timing attacks

Secure Defaults

Authentication is enforced on every SDK request in production; it cannot be disabled outside isolated development environments.

Domain Whitelisting

Restrict SDK usage to approved domains:

Configuration

Set allowed domains in the Dashboard under Settings > Security:

app.example.com
staging.example.com
localhost:3000

Enforcement

Scenario	Behavior
Empty whitelist	SDK works on any domain
Whitelist configured	SDK only works on listed domains
Unlisted domain	SDK initialization fails

Remember to include all environments (production, staging, development) in your whitelist.

Data Minimization

Moss follows data minimization principles:

Collected Data

Data Type	Purpose	Retention
User ID	Session identification	Configurable
Screenshots	Visual context for AI	Session duration
Chat messages	Conversation history	Configurable
Session recordings	Replay and debugging	Configurable

User Control

Users can control data collection via SDK configuration:

<script>
  window.mossSettings = {
    apiUrl: 'https://moss-api.viamoss.ai',
    userId: 'USER_ID',
    enableSessionRecording: false,       // Disable recordings
    enableScreenHistoryRecording: false, // Disable history
  };
</script>
<script src="https://cdn.viamoss.ai/moss-sdk@latest.min.js?applicationId=YOUR_APP_ID"></script>

To apply the same settings after the SDK has loaded, pass them to window.MossSDK.boot(...):

await window.MossSDK.boot({
    enableSessionRecording: false,
    enableScreenHistoryRecording: false,
})

Getting Started

SDK

Dashboard

Configuration

Security

Guides

Resources

Overview

Encryption

In Transit

At Rest

Input Validation

Schema Validation

Validation Rules

Rejection Behavior

Sensitive Data Handling

Automatic Redaction

Recursive Sanitization

Credential Storage

API Keys

JWT Signing Keys

Password-Like Secrets

Secure Defaults

Domain Whitelisting

Configuration

Enforcement

Data Minimization

Collected Data

User Control

Next Steps

Audit Logging

Compliance

​Overview

​Encryption

​In Transit

​At Rest

​Input Validation

​Schema Validation

​Validation Rules

​Rejection Behavior

​Sensitive Data Handling

​Automatic Redaction

​Recursive Sanitization

​Credential Storage

​API Keys

​JWT Signing Keys

​Password-Like Secrets

​Secure Defaults

​Domain Whitelisting

​Configuration

​Enforcement

​Data Minimization

​Collected Data

​User Control

​Next Steps

Audit Logging

Compliance

Overview

Encryption

In Transit

At Rest

Input Validation

Schema Validation

Validation Rules

Rejection Behavior

Sensitive Data Handling

Automatic Redaction

Recursive Sanitization

Credential Storage

API Keys

JWT Signing Keys

Password-Like Secrets

Secure Defaults

Domain Whitelisting

Configuration

Enforcement

Data Minimization

Collected Data

User Control

Next Steps