How does Open Analytics authenticate and isolate user sessions?

Sessions are managed using cryptographically signed JSON Web Tokens stored exclusively in HttpOnly, Secure, SameSite=Lax cookies. Telemetry database queries enforce project-level boundaries, preventing cross-tenant data leaks.

How are IP addresses handled securely during telemetry collection?

Raw IP addresses are masked in volatile memory by zeroing the last octet (IPv4 /24) or stripping host portions (IPv6 /64). Ephemeral hashes are generated using daily rotating 256-bit cryptographic salts, and raw IPs are never stored to disk.

What is Open Analytics vulnerability disclosure SLA?

Reports submitted to security@openanalytics.org.in receive initial engineering acknowledgment within 48 business hours, following coordinated disclosure guidelines.

Open Analytics

Telemetry Operational

Launch Dashboard

Enterprise-Grade Security Standards

Security Architecture & Data Protection

Explore how Open Analytics safeguards analytical telemetry, enforces multi-tenant RBAC isolation, isolates session cookies, and purges ephemeral data through cryptographic design.

Zero Cookies

In-Memory IP Masking

365-Day Automated Purge

RFC 9116 Compliant

Security Pillars

Security at a Glance

Encryption:TLS 1.3 / AES-256

Hashing:Argon2id / SHA-256

Salt Lifecycle:24 Hours (Rotating)

TTL Retention:365 Days Max

Disclosure SLA:48 Business Hours

Section•Session Hardening

Stateless Cryptographic Sessions & RBAC Isolation

All administrative interactions utilize tamper-proof JSON Web Tokens stored exclusively in secure, browser-isolated cookies with strict role boundaries.

HttpOnly & SameSite Cookie Storage

RFC 6265bis • HttpOnly • Secure • SameSite=Lax

Authentication credentials never touch localStorage or client-side JavaScript execution context. Cookies are set with HttpOnly, Secure, and SameSite=Lax flags to eliminate cross-site scripting (XSS) exfiltration risks.

Argon2id & Bcrypt Password Hashing

12 salt rounds • Memory-hard computational cost

User credentials are protected using salted password hashes with memory-hard cost factors designed to withstand GPU-accelerated dictionary and rainbow table attacks.

Granular 5-Tier Project RBAC

Zero cross-tenant data leakage by design

Database operations enforce workspace boundaries (Owner, Admin, Editor, Member, Super Admin). Every single query enforces multi-tenant isolation via mandatory projectId scoping.

Session Cookie Configuration

// lib/auth.ts - Hardened session cookie provisioning
res.cookies.set("open_session", jwtToken, {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  path: "/",
  maxAge: 60 * 60 * 24 * 30, // 30-day session lifetime
});

HTTP Security Headers Profile

Defense-in-Depth HTTP Headers

Every response dispatched by Open Analytics Cloud and recommended for self-hosted deployments includes strict modern browser defenses.

Header	Policy Value	Security Defense
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload	Forces browser HTTPS connection for 2 years and protects against SSL stripping.
X-Content-Type-Options	nosniff	Prevents MIME-type sniffing attacks by disallowing content type overrides.
X-Frame-Options	DENY	Blocks UI clickjacking by prohibiting rendering inside iframes.
Referrer-Policy	strict-origin-when-cross-origin	Prevents leaking sensitive pathnames or tokens across origin boundaries.
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=()	Restricts browser feature access from the telemetry tracking surface.

Found a Security Issue?

Responsible Vulnerability Disclosure

Please report potential security vulnerabilities to our team. We investigate all reports promptly and coordinate responsible disclosures.

Report Vulnerability