---
title: "Security"
description: "Ring Platform security architecture — RBAC, confidential tiers, API hardening, and layout-level auth gates"
locale: "en"
---
# Security Model

> **Info**
> Use **Founder** / **Developer** tabs in the docs sidebar. This page covers the **architecture-level** security model; operational hardening and compliance depth live in [Security & Compliance](../features/security).

Ring Platform defense is **layered**: Auth.js establishes identity, **layout-level gates** enforce role access before Server Actions run, JSONB rows carry visibility flags, and API routes apply Zod validation plus rate limits. There is no single middleware that replaces domain checks — each layer adds a narrow guarantee.

## Security layers at a glance

| Layer | Founder view | Developer anchor |
|-------|--------------|------------------|
| **Identity** | Magic link, Google, Apple, wallet sign-in | Auth.js v5 — [Authentication](./authentication) |
| **Roles** | Visitor → Subscriber → Member → Confidential → Admin | `users.data.role` lowercase enum |
| **Route gates** | Paid tiers unlock posting & confidential reads | Authenticated route layouts call `auth()` |
| **Data visibility** | Confidential entities/opportunities hidden from public lists | `visibility` fields + cache tags by role |
| **API surface** | Webhooks verified server-side only | Zod + RBAC in route handlers |
| **Transport** | HTTPS everywhere; secrets never in MDX | CORS + rate limiting on `/api/*` |

### For founders

## What founders configure

### Role ladder (typical clone)

  
- **[Subscriber](/docs/features/membership.md)** — Can browse and receive notifications — baseline community access.

  
- **[Member](/docs/features/entities.md)** — Can create entities and post public opportunities.

  
- **[Confidential](/docs/features/security.md)** — Access to confidential listings and deal-room style content.

  
- **[Admin](/docs/features/admin.md)** — Moderation, analytics, store ERP, news kingdom controls.

### Confidential tier — business value

**Confidential entities and opportunities** let you run a **two-speed marketplace**: public discovery for reach, restricted listings for vetted partners (investors, government tenders, M&A). Membership upsell often maps directly to confidential access — see [Membership](../features/membership).

  Never expose production `AUTH_SECRET`, WayForPay keys, or service accounts in docs widgets, clone READMEs, or client bundles. Ring docs authoring rules forbid embedded secrets.

### Typical compliance scenarios

- **GDPR delete-my-data** — account deletion flows through Auth.js + Postgres cascades ([Privacy](../features/privacy)).
- **Payment PCI scope** — card data stays on WayForPay/Stripe; Ring stores order references only ([PaymentConductor](./payment-conductor)).
- **Regional clone** — wellness/gov rings add audit logging on top of the same RBAC core.

### For developers

## Implementation map

```mermaid
flowchart LR
  subgraph Edge
    Proxy[proxy.ts — locale only]
  end
  subgraph App
    Layout[authenticated layout — auth()]
    SA[Server Action / Route Handler]
    RBAC[Role + visibility check]
    DB[(DatabaseService)]
  end
  Browser --> Proxy --> Layout --> SA --> RBAC --> DB
```

### Role enum (SSOT)

Persisted on `users.data.role` — lowercase strings validated in Zod:

{`role: z.enum([
  'visitor',
  'subscriber',
  'member',
  'confidential',
  'admin',
  'superadmin',
])`}

Permission matrices live in `features/auth/types.ts` (`canViewconfidentialOpportunities`, etc.). Prefer **typed role checks** over ad-hoc boolean flags in new code.

### Layout-level auth gates

`proxy.ts` handles **locale only** — not authentication (v1.6.0 architecture). Protected routes use App Router layouts that call `auth()` and redirect unauthenticated users before children render. See [Authentication](./authentication) and [Proxy & intl](./proxy-and-intl).

### Confidential routes

| Route | Constant |
|-------|----------|
| Confidential entities | `/confidential/entities` |
| Confidential opportunities | `/confidential/opportunities` |

Defined in `constants/routes.ts`. List caches are role-scoped; discovery sync minimizes path churn for confidential hubs ([Discovery mutation sync](./discovery-mutation-sync)).

### API hardening checklist

### Validate input with Zod at the route boundary

Never trust client JSON — mirror Server Action schemas in `/app/api/**`.

### Authorize before DatabaseService calls

Check session role + resource ownership (entity `userId`, opportunity poster).

### Rate-limit abuse-prone endpoints

Apply limiting on auth, webhook, and public write routes — patterns in [Security & Compliance](../features/security).

### Structured errors

Use `Error.cause` (ES2022) for nested failure context in services — aids logging without leaking internals to clients.

### CORS

API routes set explicit CORS for trusted clone origins only — do not widen `Access-Control-Allow-Origin` for convenience in production.

## Related documentation

  
- **[Data Validation (deep dive)](/docs/architecture/data-validation.md)** — Zod schemas, route-boundary patterns, webhook HMAC verification, and business data safety.

  
- **[Security & Compliance (deep dive)](/docs/features/security.md)** — Auth.js config, GDPR, PCI notes, Firebase rules legacy paths.

  
- **[Authentication architecture](/docs/architecture/authentication.md)** — Sessions, Postgres adapter, multi-provider setup.

  
- **[PaymentConductor](/docs/architecture/payment-conductor.md)** — HMAC webhook verification, idempotent order references.

  
- **[Privacy](/docs/features/privacy.md)** — Data retention and export for GDPR-facing clones.