> ## Documentation Index
> Fetch the complete documentation index at: https://docs.viamoss.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Protection

> How Moss protects your data through encryption, validation, and secure storage

## Overview

Moss implements multiple layers of data protection to ensure your information remains secure throughout its lifecycle.

***

## Encryption

### In Transit

All data transmitted to and from Moss is encrypted:

* **TLS 1.2+** - All API endpoints require HTTPS
* **Certificate Validation** - Strict certificate verification
* **HSTS** - HTTP Strict Transport Security headers enforced

<Info>
  HTTP requests are automatically redirected to HTTPS. Unencrypted connections
  are never accepted for API traffic.
</Info>

### At Rest

Data stored in Moss databases is protected:

* **Database Encryption** - PostgreSQL with encryption at rest
* **Credential Hashing** - All secrets stored as cryptographic hashes
* **Secure Key Storage** - Encryption keys managed separately from data

***

## Input Validation

All API inputs are validated before processing:

### Schema Validation

Every API endpoint uses Pydantic schema validation:

```python theme={null}
class SessionRequest(BaseModel):
    user_id: str
    application_id: str
    metadata: Optional[dict] = None

    @validator('user_id')
    def validate_user_id(cls, v):
        if len(v) > 256:
            raise ValueError('user_id too long')
        return v
```

### Validation Rules

| Input Type     | Validation                       |
| -------------- | -------------------------------- |
| String fields  | Length limits, format validation |
| IDs            | UUID format verification         |
| Enums          | Allowed values only              |
| Nested objects | Recursive validation             |

### Rejection Behavior

Invalid requests receive clear error responses:

```json theme={null}
{
  "detail": [
    {
      "loc": ["body", "user_id"],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}
```

***

## Sensitive Data Handling

### Automatic Redaction

Moss automatically sanitizes sensitive data before logging:

**Redacted Fields:**

* `api_key`, `apiKey`
* `authorization`
* `password`
* `secret`
* `token`
* `x-api-key`

**How It Works:**

```python theme={null}
# Before logging
{
    "user_id": "user-123",
    "api_key": "app_abc123xyz..."
}

# After sanitization
{
    "user_id": "user-123",
    "api_key": "[REDACTED]"
}
```

### Recursive Sanitization

Redaction applies to nested objects and arrays:

```python theme={null}
{
    "config": {
        "auth": {
            "token": "[REDACTED]"  # Nested fields also sanitized
        }
    }
}
```

***

## Credential Storage

### API Keys

API keys are never stored in plaintext:

| Stage      | Protection                                         |
| ---------- | -------------------------------------------------- |
| Generation | Cryptographically random (`secrets.token_urlsafe`) |
| Storage    | SHA-256 hash                                       |
| Comparison | Constant-time comparison (timing-safe)             |
| Display    | Shown once at creation, never retrievable          |

### JWT Signing Keys

JWT secrets receive enhanced protection:

| Stage      | Protection                                    |
| ---------- | --------------------------------------------- |
| Generation | 256-bit entropy (`secrets.token_urlsafe(32)`) |
| Storage    | Encrypted at rest                             |
| Rotation   | Support for multiple active keys              |
| Revocation | Scheduled revocation with grace period        |

### Password-Like Secrets

All password-equivalent credentials use:

* **Argon2id** - Memory-hard hashing algorithm
* **Unique Salts** - Per-credential random salts
* **Timing-Safe Comparison** - Prevents timing attacks

***

## Secure Defaults

Authentication is enforced on every SDK request in production; it cannot be disabled outside isolated development environments.

***

## Domain Whitelisting

Restrict SDK usage to approved domains:

### Configuration

Set allowed domains in the Dashboard under **Settings > Security**:

```
app.example.com
staging.example.com
localhost:3000
```

### Enforcement

| Scenario             | Behavior                         |
| -------------------- | -------------------------------- |
| Empty whitelist      | SDK works on any domain          |
| Whitelist configured | SDK only works on listed domains |
| Unlisted domain      | SDK initialization fails         |

<Warning>
  Remember to include all environments (production, staging, development) in
  your whitelist.
</Warning>

***

## Data Minimization

Moss follows data minimization principles:

### Collected Data

| Data Type          | Purpose                | Retention        |
| ------------------ | ---------------------- | ---------------- |
| User ID            | Session identification | Configurable     |
| Screenshots        | Visual context for AI  | Session duration |
| Chat messages      | Conversation history   | Configurable     |
| Session recordings | Replay and debugging   | Configurable     |

### User Control

Users can control data collection via SDK configuration:

```html theme={null}
<script>
  window.mossSettings = {
    apiUrl: 'https://moss-api.viamoss.ai',
    userId: 'USER_ID',
    enableSessionRecording: false,       // Disable recordings
    enableScreenHistoryRecording: false, // Disable history
  };
</script>
<script src="https://cdn.viamoss.ai/moss-sdk@latest.min.js?applicationId=YOUR_APP_ID"></script>
```

To apply the same settings after the SDK has loaded, pass them to `window.MossSDK.boot(...)`:

```javascript theme={null}
await window.MossSDK.boot({
    enableSessionRecording: false,
    enableScreenHistoryRecording: false,
})
```

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Audit Logging" icon="clipboard-list" href="/en/security/audit-logging">
    Track and review all system activity
  </Card>

  <Card title="Compliance" icon="certificate" href="/en/security/compliance">
    GDPR, data deletion, and certifications
  </Card>
</CardGroup>