Web usershttpOnly cookies, then
require_permission()Security
¶ Security Overview
ReplyBox security rests on tenant isolation, RBAC, httpOnly cookies, HMAC internal callbacks, encrypted session/media storage, and careful production secret handling.
Tenant isolation
RBAC
httpOnly cookies
HMAC internal callbacks
Encrypted session/media storage
Production secret handling
Where the boundaries sit
¶ Who talks to the API, and what guards each path
Public integrationsAPI tokens and webhook signatures
ReplyBox APIEvery user-facing row carries
organization_idConnectorHMAC-signed HTTP callbacks
Object storageSessions and media encrypted at rest
Main boundaries
¶ Six boundaries, and what enforces each one
Tenant boundary
¶ Organizations never see each other's data
Enforced by
Tenancy and RBAC
organization_id on user-facing rows.User permissions
¶ Each endpoint checks what the user may do
Enforced by
Authentication and RBAC
require_permission() on REST endpoints.Internal connector trust
¶ The API only trusts signed connector calls
Enforced byHMAC-signed HTTP callbacks.
HMAC internal API
Session confidentiality
¶ WhatsApp sessions are unreadable without the key
Enforced by
Media and session encryption
CHANNEL_SESSION_KEYMedia confidentiality
¶ Stored media is unreadable without the key
Enforced by
Media and session encryption
MEDIA_OBJECT_KEYPublic integrations
¶ Outside systems authenticate and verify
Enforced byAPI tokens and webhook signatures.
Keep in view
¶ Secrets and open security items
Production secrets are part of the boundary: the API and connector share keys, and a leaked or mismatched key breaks the guarantees above. Known gaps are tracked separately.