Security Whitepaper

1. Executive Summary

This document describes Motif’s security controls: authentication, isolation, encryption, auditing, and incident response.

Key Security Commitments

• TLS for data in transit; AES-256 at rest on managed database and object storage, plus application-level AES-256-GCM for OAuth and MFA secrets
• Multi-tenant data isolation with organization-scoped queries and database row-level security
• Role-based access control (RBAC)
• Audit logging of authentication, role, membership, query, and consent events
• No storage of plaintext passwords or magic-link tokens

2. Authentication & Access Control

2.1 Authentication Methods

Motif supports two primary authentication methods, plus optional MFA:

Google OAuth 2.0

• PKCE (Proof Key for Code Exchange)
• ID token validation against Google’s public keys
• State parameter validation to prevent CSRF attacks

Passwordless Magic Link

• Cryptographically secure random tokens
• Tokens stored as cryptographic hashes only
• Time-limited expiration window
• Single-use tokens with immediate invalidation after use

Multi-factor authentication (optional)

• TOTP-based MFA that Motif manages
• Google account MFA may also apply when signing in with Google; that is Google’s control, not Motif’s

2.2 Session Management

• Signed JWT access and refresh tokens in HttpOnly cookies
• Refresh-token families tracked by token id (jti) for rotation and reuse detection
• Support for session revocation (single session or all sessions)
• Session metadata tracking (user agent, last activity)
• Session invalidation on reuse detection and related security events

2.3 Rate Limiting & Account Protection

• Rate limiting on authentication endpoints
• Progressive account lockout after multiple failed attempts
• IP-based and email-based rate limiting for magic links
• Domain-level signup limits to prevent abuse

2.4 Cookie Security

• HttpOnly flag enabled (prevents XSS token theft)
• Secure flag for HTTPS connections
• SameSite=Lax for CSRF protection
• Domain-scoped cookies on production

3. Data Protection

3.1 Encryption In Transit

Data transmitted to and from Motif is encrypted using TLS, including:

• User authentication requests
• Application API traffic
• Third-party service integrations

3.2 Encryption At Rest

• Managed database (Neon) and object storage (Cloudflare R2) encrypt data at rest with AES-256
• OAuth tokens and MFA secrets are encrypted with AES-256-GCM before database storage
• Key material for those application secrets uses PBKDF2 key derivation with authenticated encryption (GCM)

3.3 Multi-Tenant Data Isolation

• Organization-level data segregation enforced in application queries
• Row-Level Security (RLS) policies on data tables
• Requests scoped to organization and user context after authentication

3.4 Data Classification

3.5 Data Flow Overview

User Request → TLS → Application (Vercel) → Authentication Check
                                    ↓
                              Authorization / RLS
                                    ↓
              Database / object storage (encrypted at rest, org-isolated)
                                    ↓
              AI pipeline compute (Netcup) → OpenRouter → model providers
                                    ↓
                              Results returned

Key security boundaries:

• External communication uses TLS
• Authentication is validated before protected data access
• Organization isolation is enforced in application code and RLS policies

4. Role-Based Access Control (RBAC)

4.1 Role Hierarchy

Team invites and non-owner roles apply where the plan supports multiple seats. Self-serve single-seat accounts are owner-only in practice.

4.2 Permission Categories

• Billing: Read and manage subscription settings; allocate seat budgets where applicable
• Settings: Organization configuration
• Members: View, invite, remove, and change a member’s role
• Audit: View and download audit logs
• Usage: View usage statistics and quotas
• Research: Upload articles, annotate the graph, edit reports, refresh the knowledge graph

4.3 Permission Enforcement

• Permissions checked on protected routes before sensitive actions
• Organization membership verified for org-scoped requests
• Access is the role template (Owner, Admin, or Member). Changing a member’s role is how access changes; per-permission overrides are not stored

5. Audit & Monitoring

5.1 Authentication Event Logging

Authentication events are logged, including:

• Successful and failed login attempts
• Session creation and revocation
• Magic-link requests
• Account lockout events
• OAuth token exchanges
• Anomaly-enforcement actions (MFA challenge, email re-verify, temporary block)

5.2 Activity Tracking

• Research queries (pipeline runs) with timestamps
• Role changes
• Organization membership changes
• Consent grant and withdrawal events

5.3 Login Anomaly Checks

On sign-in, Motif scores risk from signals such as:

• Failed attempts and high login volume from an IP
• Datacenter IP ranges and bot-like user agents
• Rapid device or IP-subnet changes relative to recent successful logins
• Trust signals (known device, known IP range, MFA enabled, account age)

Actions can include allow, log-only, require Motif MFA, prompt MFA setup, email re-verification, or a temporary block. This is not geographic (country/city) anomaly detection and does not page an on-call system by itself.

5.4 Log Retention

Audit logs are retained for security investigation and compliance support. Retention varies by log type.

6. Incident Response

6.1 Incident Classification

6.2 Response Timeline

Internal targets, not contractual guarantees: Support & SLA.

6.3 Communication Procedures

• Affected customers notified for security incidents that affect them
• Post-incident summary for critical and high severity incidents when customers were affected
• Security reports: hello@motif.bio

6.4 Post-Incident Review

• Root cause analysis for security incidents
• Remediation tracked to completion
• Preventive follow-ups where appropriate

7. Infrastructure Security

7.1 Cloud Infrastructure

• Application hosting on Vercel; database on Neon; object storage on Cloudflare R2; cache/queues on Upstash; AI pipeline compute on Netcup
• Providers apply their own patching and platform encryption at rest
• Services are separate managed products (not a Motif-operated private network between them)

7.2 Application Security

• Input validation on authenticated and public forms and APIs
• SQL injection prevention via parameterized queries
• XSS mitigation via framework output encoding and HttpOnly cookies
• CSRF protection via OAuth state tokens, SameSite cookies, and a CSRF cookie checked on mutating API requests

7.3 Availability and Abuse Resistance

• Application-level rate limiting on authentication and sensitive endpoints
• Platform autoscaling on Vercel
• Static Next.js assets served through Vercel’s edge network (no separate CDN product)
• Motif does not run a dedicated DDoS scrubbing or traffic-analytics product beyond provider defaults and application rate limits

7.4 Dependency Management

• Regular dependency updates
• Dependabot pull requests for npm and GitHub Actions
• Periodic npm audit as part of SOC 2 evidence collection
• Prefer a minimal production dependency set

8. Third-Party Security

8.1 Vendor Assessment

Current subprocessors, locations, and certifications are in the Trust Center.

• Data processing terms in place for subprocessors that process personal data
• Vendor security posture reviewed when onboarding or materially changing a subprocessor
• Subprocessor list kept current in the Trust Center
• Minimal data sharing limited to what each vendor needs to provide its service

9. Security Roadmap

Compliance status (SOC 2, ISO 27001, penetration testing): Trust Center.

Planned on this paper’s controls: stronger login-risk signals where useful.

We welcome security assessments from prospective enterprise customers.

10. Security Contact

For security concerns, vulnerability reports, or questions about our security practices:

Email: hello@motif.bio

Acknowledgement and process: Trust Center. Include a description, steps to reproduce, impact, and any suggested fix.