Security
Government-grade security controls for advertising platform management. 12 NIST 800-53 controls across 6families — all implemented.
NIST 800-53 Controls
Security controls aligned with selected NIST 800-53 families.
Access Control
Account Management
Role-based access control with two roles (operator, admin). Organization-scoped user management. OAuth-based account provisioning.
Access Enforcement
Every query filters by organizationId for multi-tenant isolation. requireRole() guards on API routes. requireAuth() on all protected endpoints.
Unsuccessful Logon Attempts
5-attempt lockout with 30-minute duration. Database-backed rate limiting that persists across serverless cold starts.
Session Termination
30-minute inactivity timeout. Activity timestamp (lastActivityAt) updated on every authenticated request via JWT callback. Session automatically terminated and user redirected to login after 30 minutes of inactivity. 5-minute warning displayed before timeout. Exempt paths: /login, /api/auth, /verify-mfa.
Audit & Accountability
Audit Events
Immutable audit_logs table records every mutation with userId, orgId, entityType, action, and metadata. Structured JSON logging via Pino with 50+ sensitive field redaction patterns.
Configuration Management
Least Functionality
31 production dependencies — no unnecessary services. No AI/LLM integrations. No global state management library. Server components as default. Content Security Policy restricts resource loading.
Identification & Authentication
Multi-Factor Authentication
TOTP authenticator app with HMAC-SHA256 hashed backup codes. Optional for all roles, available in Settings.
Authenticator Management
AES-256-GCM encrypted MFA secrets with PBKDF2 key derivation. Per-deployment encryption salt. OAuth tokens encrypted at rest.
System & Communications Protection
Transmission Confidentiality
TLS 1.2+ enforced on all connections via Vercel edge network. HSTS with 1-year max-age, includeSubDomains, and preload directive.
Cryptographic Protection
AES-256-GCM for Meta token encryption. PBKDF2 key derivation with per-deployment salt. HMAC-SHA256 for cron authentication and backup code hashing.
Protection of Information at Rest
Meta access tokens and page tokens encrypted with AES-256-GCM before database storage. Per-deployment ENCRYPTION_SALT prevents cross-environment decryption.
System & Information Integrity
System Monitoring
Sentry captures server and client errors with session replays and source maps. Pino structured JSON logging with 50+ sensitive field redaction patterns. Stuck job recovery cron every 5 minutes. Dispute webhook alerts.
Additional Security Features
- OAuth 2.0 authentication via Meta (no passwords stored)
- Role-based access control (Operator, Admin)
- Organization-level data isolation on every query
- HMAC-SHA256 authenticated cron jobs
- CSRF protection on all mutations
- Rate limiting on all API endpoints (database-backed)
- Content Security Policy headers
- Pino structured logging with 50+ field redaction patterns
Compliance
FAR 52.204-25 (Section 889)
No prohibited telecommunications equipment. Infrastructure provider manifest and dependency audit available. Full compliance attestation generated per organization.
View AttestationGDPR
Data deletion requests honored via public endpoint. No sale or sharing of personal data; the Global Privacy Control (GPC) browser signal is recognized.
FedRAMP-Aligned
Security controls aligned with 12 selected NIST 800-53 controls across 6 families.
Vulnerability Reporting
If you discover a security vulnerability, please report it responsibly. Contact our security team at security@formationads.com and we will respond within 48 hours.
Built for Government Trust
See how Formation Ads delivers compliant advertising infrastructure your organization can rely on.