> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pensionsportal.ie/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Defense-in-depth security posture for PensionsPortal.ie — an IORP II compliance platform for Irish pension trustees.

PensionsPortal.ie is built to meet the security obligations of IORP II, the GDPR, and the Pensions Authority's expectations for technology-enabled pension administration. Security is not a single control but a layered architecture: every layer assumes the others may fail.

## Defense-in-Depth Layers

<CardGroup cols={2}>
  <Card title="Network & CDN" icon="shield">
    Cloudflare WAF sits in front of all traffic. DDoS mitigation, bot management, and IP reputation filtering are applied before requests reach Vercel's edge.
  </Card>

  <Card title="Transport Security" icon="lock">
    All connections are TLS 1.2+. HSTS with a two-year max-age and preload is enforced at the HTTP header layer via `next.config.ts`.
  </Card>

  <Card title="Authentication" icon="user-check">
    Auth.js v5 (NextAuth) with bcrypt-hashed passwords and JWT sessions. Credentials are never logged or transmitted in plaintext.
  </Card>

  <Card title="Authorisation & Tenancy" icon="building">
    Role-based access control (RBAC) with four roles. Every data query is scoped by `brokerId` / `schemeId` — cross-tenant access is structurally impossible.
  </Card>

  <Card title="Data Protection" icon="database">
    PPS numbers are AES-256 encrypted at the application layer before storage. The encryption key is held only in Vercel environment variables.
  </Card>

  <Card title="Audit Trail" icon="list-check">
    An append-only `audit_logs` table records every material action. No UPDATE or DELETE is permitted on audit rows.
  </Card>

  <Card title="Observability" icon="eye">
    Sentry (EU region) captures errors and performance traces. Structured logs via Pino feed into alerting pipelines.
  </Card>

  <Card title="AI Guardrails" icon="robot">
    All AI-generated changes require explicit broker approval via the Change Proposal workflow before any data mutation occurs.
  </Card>
</CardGroup>

## Hosting & Data Residency

| Component        | Provider         | Region                            |
| ---------------- | ---------------- | --------------------------------- |
| Application      | Vercel           | EU (dub1, cdg1, arn1)             |
| Database         | Neon PostgreSQL  | UK (aws-eu-west-2)                |
| AI Inference     | Anthropic Claude | EU (`ANTHROPIC_INFERENCE_GEO=EU`) |
| Error Monitoring | Sentry           | EU (de.sentry.io)                 |
| CDN / WAF        | Cloudflare       | Global edge                       |
| Email            | Resend           | —                                 |

All personal data processing remains within the EU/EEA or UK (an adequacy decision jurisdiction). No personal data is transmitted to US-based services in identifiable form.

## Regulatory Context

PensionsPortal.ie operates as a technology platform for pension trustees subject to:

* **IORP II Directive** (2016/2341/EU) — transposed into Irish law via the IORP II Regulations 2021
* **GDPR** — data minimisation, encryption, right of erasure, breach notification within 72 hours
* **Pensions Authority Guidance** — fit-and-proper requirements, governance documentation

<Note>
  This document reflects the technical security posture of the platform. Trustees retain ultimate governance responsibility and must ensure their own operational security practices (access controls, device management, incident response) complement these platform controls.
</Note>

## Security Pages

| Topic                    | Page                                                                             |
| ------------------------ | -------------------------------------------------------------------------------- |
| Authentication           | [NextAuth Configuration](/security/authentication-nextauth)                      |
| MFA & Privileged Access  | [MFA and Privileged Access](/security/mfa-and-privileged-access)                 |
| Authorisation            | [RBAC Model](/security/authorization-rbac)                                       |
| Sessions & Cookies       | [Session and Cookie Policy](/security/session-and-cookie-policy)                 |
| Secure Development       | [SDLC](/security/secure-development-sdlc)                                        |
| Vulnerability Management | [Vulnerability Management](/security/vulnerability-management)                   |
| Secrets                  | [Secrets Management](/security/secrets-management)                               |
| Encryption               | [Encryption at Rest and in Transit](/security/encryption-at-rest-and-in-transit) |
| HTTP Headers             | [Security Headers & CSP](/security/security-headers-csp-hsts)                    |
| Rate Limiting            | [Rate Limiting and Abuse](/security/rate-limiting-and-abuse)                     |
| Audit Logging            | [Audit Logging](/security/audit-logging)                                         |
| Monitoring               | [Monitoring and Alerting](/security/monitoring-and-alerting)                     |
| Sentry                   | [Sentry Observability](/security/sentry-observability)                           |
| WAF                      | [Cloudflare WAF and Zero Trust](/security/cloudflare-waf-and-zero-trust)         |