Security Best Practices

Comprehensive security guidelines for protecting your Twig AI deployment and data.

Account Security

Password Policy

✅ Strong Passwords:

• Minimum 12 characters (16+ recommended)

• Mix of uppercase, lowercase, numbers, symbols

• Unique per service (use password manager)

• No dictionary words or personal info

✅ Password Manager:

• 1Password, Bitwarden, LastPass

• Generate random passwords

• Secure storage

• Team vaults for shared access

Multi-Factor Authentication (MFA)

✅ Enable MFA:

• Required for admin roles

• Strongly recommended for all users

• Use authenticator app (not SMS)

• Backup codes stored securely

✅ Supported Methods:

• TOTP authenticator apps (Google, Authy)

• Hardware keys (YubiKey, Security Key)

• SMS (less secure, backup only)

Account Monitoring

✅ Monitor for:

• Unusual login locations

• Failed login attempts

• New device logins

• Permission changes

• Suspicious activity

API Security

API Key Management

✅ Best Practices:

# Store in environment variables
export TWIG_API_KEY="sk_live_..."

# Never in code
❌ const key = "sk_live_abc123..."

# Use secret managers
✅ AWS Secrets Manager, Vault

✅ Key Rotation:

• Rotate every 90 days

• Different keys per environment

• Revoke immediately if compromised

• Monitor key usage

✅ Scoped Keys:

{
  "scope": ["chat", "agents:read"],
  "notScope": ["agents:delete", "admin"]
}

Network Security

✅ HTTPS Only:

• All API calls over HTTPS

• Certificate pinning (mobile apps)

• TLS 1.3 preferred

✅ IP Whitelisting:

{
  "allowedIPs": [
    "203.0.113.0/24",
    "198.51.100.0/24"
  ]
}

✅ Rate Limiting:

• Implement client-side rate limiting

• Respect 429 responses

• Use exponential backoff

Request Security

✅ Input Validation:

// Validate inputs
function sanitizePrompt(prompt) {
  // Remove potential injection attempts
  // Limit length
  // Sanitize special characters
  return prompt.trim().slice(0, 4000);
}

✅ Output Encoding:

• Escape HTML in responses

• Sanitize URLs

• Validate JSON

Data Security

Data Classification

Level	Examples	Controls
Public	Marketing materials	Standard
Internal	Company docs	Auth required
Confidential	Customer data	Encryption + RBAC
Restricted	Financial, PII	Encryption + MFA + Audit

Encryption

✅ At Rest:

• AES-256 for databases

• Encrypted file storage

• Encrypted backups

• Key management (AWS KMS)

✅ In Transit:

• TLS 1.3

• Perfect forward secrecy

• Strong cipher suites

• Certificate validation

Data Access

✅ Principle of Least Privilege:

• Grant minimum necessary access

• Time-limited access for contractors

• Regular access reviews

• Remove unused permissions

✅ Data Segregation:

• Organization data isolation

• No cross-org data access

• Separate environments (dev/staging/prod)

Application Security

Secure Configuration

✅ Agent Settings:

{
  "configAIUseOnlyPrivateData": true,  // No external data
  "requireCitation": true,             // Always cite sources
  "piiDetection": true,                // Detect sensitive data
  "contentFiltering": true             // Block inappropriate
}

✅ Deployment:

• Staging environment for testing

• Gradual rollout

• Rollback procedures

• Health checks

Secure Integrations

✅ OAuth Security:

• Use state parameter (CSRF protection)

• Validate redirect URIs

• Short-lived authorization codes

• Secure token storage

✅ Webhook Security:

• Verify signatures

• HTTPS endpoints only

• Rate limit webhook handlers

• Validate payloads

Operational Security

Access Control

✅ User Management:

• Regular access reviews

• Remove inactive users (90 days)

• Verify role assignments

• Audit group memberships

✅ Privileged Access:

• Limit Super Admin role (2-3 users)

• Require MFA for admin accounts

• Monitor admin activity

• Regular recertification

Logging & Monitoring

✅ Comprehensive Logs:

• Authentication events

• Authorization failures

• Data access

• Configuration changes

• API calls

• Errors and exceptions

✅ Monitoring:

• Failed login attempts

• Unusual access patterns

• Performance anomalies

• Security events

✅ Alerting:

{
  "securityAlerts": {
    "failedLogins": {
      "threshold": 5,
      "window": 300,  // 5 minutes
      "action": "LOCK_ACCOUNT"
    },
    "suspiciousActivity": {
      "enabled": true,
      "notify": "[email protected]"
    }
  }
}

Incident Response

✅ Preparation:

• Incident response plan documented

• Team roles defined

• Escalation procedures

• Contact list maintained

✅ Response Process:

1. Detection and analysis

2. Containment

3. Eradication

4. Recovery

5. Post-incident review

✅ Communication:

• Internal notification channels

• Customer notification templates

• Regulatory reporting procedures

Vulnerability Management

Patch Management

✅ Regular Updates:

• Security patches applied within 48 hours

• Platform updates monthly

• Dependency updates weekly

• Zero-day vulnerabilities: Immediate

Vulnerability Scanning

✅ Continuous Scanning:

• Automated daily scans

• Dependency vulnerability checks

• Container image scanning

• Code analysis (SAST)

Penetration Testing

✅ Annual Testing:

• External penetration test

• Internal vulnerability assessment

• Social engineering tests

• Report and remediation

Third-Party Security

Vendor Assessment

✅ Sub-Processor Review:

• Security questionnaires

• Compliance verification

• Contract terms

• Regular reassessment

✅ Current Sub-Processors:

• AWS (SOC 2, ISO 27001)

• OpenAI (SOC 2, enterprise agreement)

• Pinecone (SOC 2)

• Stripe (PCI Level 1)

Integration Security

✅ OAuth Integrations:

• Minimum required scopes

• Token encryption

• Regular token rotation

• Revocation procedures

Developer Security

Secure Coding

✅ Practices:

• Input validation

• Output encoding

• Parameterized queries

• Error handling (don't leak info)

• Secure dependencies

✅ Code Review:

• Peer review required

• Security review for sensitive changes

• Automated security scanning

API Security

✅ Implementation:

// Validate inputs
if (!isValidAgentId(agentId)) {
  throw new Error('Invalid agent ID');
}

// Rate limiting
const rateLimit = checkRateLimit(userId);
if (rateLimit.exceeded) {
  throw new RateLimitError();
}

// Authorization
if (!canAccessAgent(userId, agentId)) {
  throw new ForbiddenError();
}

Security Checklist

Initial Setup

• Enable MFA for all admins

• Configure SSO (if available)

• Set strong password policy

• Review default permissions

• Enable audit logging

• Configure security alerts

• Review sub-processors

• Sign DPA

• Configure data residency

• Set up backup contacts

Ongoing (Monthly)

• Review access logs

• Check for failed logins

• Audit API key usage

• Remove inactive users

• Review group memberships

• Check security alerts

• Update contact information

Ongoing (Quarterly)

• Full access review

• Recertify privileged access

• Review and update security policies

• Test incident response plan

• Rotate API keys

• Review compliance status

• Update security training

Annual

• Comprehensive security audit

• Review all users and permissions

• Update security documentation

• Review vendor security

• Penetration testing

• Compliance recertification

• Update business continuity plan

Reporting Security Issues

Responsible Disclosure

Found a security vulnerability?

Email: [email protected]

Include:

• Description of vulnerability

• Steps to reproduce

• Impact assessment

• Suggested fix (if known)

We commit to:

• Acknowledge within 24 hours

• Provide updates every 3-5 days

• Fix critical issues within 48 hours

• Credit researchers (with permission)

Bug Bounty Program

Status: Enterprise customers only

Contact [email protected] for details.

Resources

• Security Portal: security.twig.so

• Trust Center: trust.twig.so

• Status Page: status.twig.so

• Security Email: [email protected]

Next Steps

• Authentication & Authorization - Access control

• Data Privacy - Privacy protection

• Compliance - Regulatory requirements

• User Permissions - Manage access