Security

Security is foundational to TCX Hub. We handle sensitive 3CX credentials and customer telemetry data, and we take that responsibility seriously. This page describes the technical and organizational measures we use to protect your data.

At Rest: All 3CX system credentials (API keys, extension passwords) are encrypted using AES-256-GCM with scrypt key derivation. Encryption keys are managed server-side and stored separately from the encrypted data. Database storage uses PostgreSQL with disk-level encryption.

In Transit: All connections use TLS 1.2+ encryption. API requests, webhooks, and real-time telemetry streams are all encrypted end-to-end.

Each tenant's data is stored in a separate PostgreSQL schema. There is no shared data between tenants at the application or database level. Paid tiers can optionally use dedicated databases for complete physical isolation. All API requests are scoped to the authenticated tenant - cross-tenant access is architecturally impossible.

User Authentication: We use Auth.js, with sign-in by email and password or through an OAuth provider. Multi-factor authentication (MFA) is available to every user and offers four verification methods: a TOTP authenticator app, SMS verification, one-time backup recovery codes, and an email OTP fallback.

Role-Based Access Control: Access is governed by five roles — Owner, Admin, Member, Billing, and Viewer — assigned per tenant. Each role carries a defined set of permissions that determines the data and actions it can reach.

Session Management: Sessions are held in secure, HTTP-only cookies backed by Redis, and expire automatically. We revoke them immediately at any sign of suspicious activity.

TCX Hub runs on Hetzner dedicated servers in European data centres. The platform is made up of:

- Web Application - Next.js with server-side rendering - Background Worker - an isolated process handling telemetry sync and health checks - PostgreSQL 16 - the primary database, with automated backups - Redis 7 - session storage, pub/sub, and distributed locks

Each service runs in its own isolated container, keeping the attack surface to a minimum.

Customer data is backed up automatically twice a day. Every backup is encrypted and held off-site within the European Union (Cloudflare R2), and we test restores on a regular schedule so that we can recover quickly should an incident ever occur.

We use Sentry for real-time error tracking and application monitoring. Infrastructure health is monitored continuously. Security incidents are investigated immediately and affected users are notified within 72 hours as required by GDPR.

Our development practices include:

- TypeScript strict mode with no `any` types - Zod validation on all API inputs - Drizzle ORM for all database queries (no raw SQL) - Field whitelisting on all mutation endpoints to prevent mass-assignment - Rate limiting on authentication endpoints - Environment variable validation at startup - No hardcoded secrets - all credentials via environment variables

If you discover a security vulnerability, please report it responsibly to [email protected]. We will acknowledge receipt within 24 hours and aim to resolve confirmed vulnerabilities within 7 days.