Security Guide

Appivo provides comprehensive security features out-of-the-box. Learn how to configure access control and protect your application data.

Built-in Security Features

Every Appivo application automatically includes:

Role-Based Access Control (RBAC)

Control who can access what in your application using roles.

System Roles

Appivo provides these built-in roles:

Creating Custom Roles

Define roles that match your business needs:

1. Navigate to Security in the Application Builder
2. Click Add Role
3. Name and describe the role
4. Assign permissions

Example: Department Manager Role

Role: Department Manager
Description: Manages employees in their department

Permissions:
  Employee Model:
    - Create: Yes
    - Read: Yes (own department only)
    - Update: Yes (own department only)
    - Delete: No

  TimeSheet Model:
    - Create: No
    - Read: Yes (own department)
    - Update: Yes (approve only)
    - Delete: No

  Report Model:
    - Create: No
    - Read: Yes
    - Update: No
    - Delete: No

Permission Levels

For each model, you can grant:

Assigning Roles

Roles can be assigned to:

• Individual users - Direct assignment
• Groups - All group members inherit role
• Dynamically - Based on user attributes

Access Control Lists (ACLs)

For fine-grained control over specific records, use ACLs.

When to Use ACLs

• Restrict access to individual records
• Override role permissions for specific cases
• Implement record-level security

Example: Confidential Documents

Model: Document
Record: Q4 Financial Report
ACL:
  - Finance Team: Read, Update
  - Executives: Read only
  - All Others: No access

ACL Configuration

1. Navigate to the record or model
2. Open Access Control settings
3. Add ACL entries for users, groups, or roles
4. Set specific permissions

Data Security

Tenant Isolation

Appivo automatically isolates data between tenants:

• Each tenant has separate data storage
• Cross-tenant queries are impossible
• Tenant context is enforced at the database level

Data at Rest

All stored data is encrypted:

• Database encryption
• File storage encryption
• Backup encryption

Data in Transit

All communication uses TLS encryption:

• API calls
• User sessions
• File transfers

Field-Level Security

Control access to individual fields within models.

Sensitive Field Configuration

Mark fields as sensitive to:

• Hide from unauthorized users
• Mask in logs
• Exclude from exports

Example: Salary Field

Model: Employee
Field: salary
Security:
  - Visible to: HR Team, Managers
  - Hidden from: Other employees
  - Masked in logs: Yes

Authentication

Built-in User Management

Appivo provides complete user management:

• User registration
• Password encryption
• Password reset
• Profile management
• API key generation

Password Policies

Configure password requirements:

Two-Factor Authentication

Enable 2FA for additional security:

1. Navigate to Security Settings
2. Enable Two-Factor Authentication
3. Configure methods (SMS, authenticator app)
4. Set enforcement level (optional, required)

Session Management

Control user sessions:

Audit Logging

Track all important actions in your application.

What Gets Logged

• User login/logout
• Data creation, updates, deletions
• Permission changes
• Configuration changes
• API access

Viewing Audit Logs

1. Navigate to Monitoring > Audit Logs
2. Filter by date, user, action type
3. Export for analysis

Example Audit Entry

Timestamp: 2024-01-15 14:32:18
User: john.smith@company.com
Action: UPDATE
Model: Customer
Record: CUS-12345
Changes:
  - status: "Active" → "Inactive"
  - updated_at: automatic
IP Address: 192.168.1.100

API Security

API Key Authentication

Generate API keys for external integrations:

1. Navigate to Settings > API Keys
2. Click Generate New Key
3. Set permissions and expiration
4. Securely store the key

API Key Best Practices

• Use separate keys for each integration
• Set minimum required permissions
• Rotate keys periodically
• Revoke unused keys

Rate Limiting

Protect against abuse:

Security Best Practices

Principle of Least Privilege

• Grant minimum required access
• Review permissions regularly
• Remove access when no longer needed

Regular Audits

• Review user permissions quarterly
• Check for inactive accounts
• Audit sensitive data access

Secure Development

• Validate all user input
• Use parameterized queries (handled by Appivo)
• Test security configurations

Incident Response

• Monitor for unusual activity
• Have a response plan
• Know how to revoke access quickly

Compliance

Appivo helps you meet compliance requirements:

Data Protection

• GDPR-ready data handling
• Data export capabilities
• Right to deletion support

Access Controls

• Role-based access for SOC 2
• Audit trails for compliance
• Separation of duties

Common Security Patterns

Approval Workflow

Implement approval for sensitive operations:

Model: PurchaseOrder
Field: status

When status changes to "Pending Approval":
  - Notify approvers
  - Lock record for editing
  - Require manager approval

When approved:
  - Log approval with approver info
  - Proceed to processing

Data Classification

Classify data by sensitivity:

Classification Levels:
  - Public: No restrictions
  - Internal: Authenticated users only
  - Confidential: Specific roles only
  - Restricted: Named individuals only

Next Steps

• Authentication Guide - User management details
• API Integration - Secure external connections
• Data Modeling - Design secure data structures