Route51 · Architecture
Route5 is a Next.js application on Vercel with Clerk authentication, Supabase Postgres for workspace data, and optional AI inference via OpenAI / xAI. The product desk is a Linear-grade SPA served from first-party static assets with a thin Route5 bridge — no parallel React desks.
2 · Identity
Sessions are Clerk-only. Forged cookie UIDs are rejected. SSO (Google/OIDC) is live; Enterprise SAML is configured through Clerk. SCIM 2.0 Users provisioning is live for Enterprise. MFA is enforceable via Clerk organization settings.
3 · Encryption
Integration tokens are encrypted at rest with AES-256-GCM. Transit uses TLS; production enables HSTS. Trust exports use SHA-256 checksums and optional HMAC-SHA256 signing. Cryptographic material fails closed in production when keys are missing.
4 · Application security
CSP, COOP, X-Frame-Options DENY, same-origin mutation checks, rate limiting (global + scoped), secure uploads (SVG rejected), and hashed API keys with scopes.
5 · Privacy & compliance pathway
GDPR/CCPA rights via DSR workflow, DPA draft, legal hold, audit trail, retention prefs. SOC 2 Type I/II and ISO 27001 are pathways with evidence collection — not fake seals. HIPAA/BAA is sales-led for regulated deals. PCI: CHD stays with Stripe.
6 · Resilience
Published targets: RTO 24h / RPO 4h for hosted SaaS (refine in MSA). Provider backups encrypted. Status at /status. DR checksum cron available for board packs.
7 · AI governance
Capture requires human approval before commitments ship. Customer data is not used to train Route5 models. Subprocessors and retention are disclosed on the trust center. Enterprise AI opt-out is enforceable in Settings.