> For the complete documentation index, see [llms.txt](https://docs.joingather.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.joingather.org/security-and-data-privacy.md). # Security & data privacy *** ### Gather Platform Software Providers #### Database + Admin Dashboard Service Provider ([Airtable](https://www.airtable.com/solutions/enterprise) • Security & Privacy) **Security Protocols:** * **Data Encryption:** * **At Rest:** Data is encrypted using AES-256 (Advanced Encryption Standard) for stored data. * **In Transit:** TLS (Transport Layer Security) is used to encrypt data transmitted between users and Airtable's servers. **Access Control:** * **Role-Based Access Control (RBAC):** Airtable supports permissions based on roles such as owner, editor, commenter, and read-only access. * **Single Sign-On (SSO):** Integration with SSO providers using SAML-based authentication (e.g., Okta, Google, Azure AD) for enterprise clients. * **Two-Factor Authentication (2FA):** Optional but supported for additional account security. **Network Security:** * **IP Whitelisting:** Enterprises can restrict access to Airtable by whitelisting specific IP addresses. * **Audit Logs:** Available for tracking changes and activities across users, databases, and workspaces. * **Rate Limiting and DDOS Protection:** Rate limiting is provided out of the box to prevent attacks **Compliance and Certifications:** * **SOC 2 Type II:** Airtable undergoes regular SOC 2 audits to ensure adherence to industry-standard security practices. * **GDPR & CCPA Compliance:** Data privacy and management practices are aligned with GDPR and CCPA regulations. *** #### Chat Messaging ([Stream](https://getstream.io/) • [Privacy & Security](https://getstream.io/security/faq/)) **Security Protocols:** * **Data Encryption:** * **At Rest:** [Stream.io](http://stream.io/) encrypts all data at rest using AES-256. * **In Transit:** All communications between clients and servers are encrypted using TLS/SSL. **Authentication & Authorization:** * **API Key Security:** Stream uses API keys to authenticate requests, which can be rotated for added security. * **Token-Based Authentication (JWT):** Users can be authenticated via JWT (JSON Web Tokens), adding a layer of security to user sessions and channel access. * **Permissions:** Fine-grained access controls for chat functionalities and resources, ensuring restricted access to messages, channels, and events based on user roles. **Data Privacy & Access Controls:** * **Role-Based Permissions:** Stream provides detailed role-based access control (RBAC) settings to manage user access to chat channels and messages. * **Private Channels:** Supports the creation of private chat channels with restricted access to authorized users only. **Network Security:** * **DDOS Protection:** [Stream.io](http://stream.io/) implements DDoS protection measures to mitigate denial-of-service attacks. * **Audit Logs:** Comprehensive logging of chat activity and API requests for monitoring and auditing purposes. **Compliance and Certifications:** * **SOC 2 Type II Certified:** Regular audits to ensure data security and integrity. * **GDPR Compliance:** [Stream.io](http://stream.io/) complies with GDPR regulations regarding data protection and user privacy. * **HIPAA Support:** Available for chat applications that require HIPAA compliance in healthcare. *** #### SMS Authentication ([Firebase Privacy & Security](https://firebase.google.com/support/privacy)) **Security Protocols:** * **Data Encryption:** * **At Rest:** Data, including authentication logs, is encrypted using AES-256. * **In Transit:** Communication between clients and Firebase servers is secured using TLS. **Authentication Security:** * **Phone Number Verification:** Firebase uses SMS-based one-time passwords (OTP) for user authentication, ensuring that only users with access to the verified phone number can log in. * **Recaptcha Integration:** To prevent automated requests, Firebase Authentication includes reCAPTCHA in its SMS verification process, adding an additional layer of security against bots. **Access Control:** * **Token-Based Authentication (ID Tokens):** Firebase issues JWT-based ID tokens for authenticated users which can be validated by the backend. * **Revocation of Tokens:** Tokens can be revoked if compromised, ensuring that users are logged out and re-authenticated. **Network Security:** * **IP Restrictions and Rules:** Firebase allows restricting access to your app based on IP addresses or geographical regions * **Rate Limiting:** Firebase enforces rate limiting on SMS requests to prevent abuse or brute-force attacks on authentication **Compliance and Certifications:** * **SOC 2, ISO 27001, and ISO 27017 Certified:** Firebase follows industry-standard security certifications and undergoes regular audits * **GDPR & CCPA Compliance:** Firebase adheres to GDPR and CCPA data privacy requirements * **HIPAA Support:** Firebase Authentication can be configured to meet HIPAA standards for healthcare apps *** #### React Native Developer Tooling ([Expo](https://expo.dev/) • [Security Policy](https://expo.dev/security)) **Security Protocols:** * **Data Encryption:** * **At Rest:** Expo does not store user data directly, but data sorted on device use their built-in secure storage solutions `expo-secure-store` to encrypt sensitive data * **In Transit:** Gather apps use HTTPS (TLS) for secure network communication via Airtable’s javascript client. This ensures that data transferred between the app and any APIs or services is encrypted in transit. **Authentication & Authorization:** * **Integration with Authentication Services:** Expo provides seamless integration with our authentication provider Firebase, ensuring secure user authentication via token-based authentication (JWT). **Access Control:** * **Permissions:** Fine-grained control over device permissions (e.g., camera, location, notifications) is provided via Expo's permission API, ensuring that users are prompted only for necessary permissions. **Code Obfuscation & Protection:** * **JavaScript Code Obfuscation:** Expo apps are built in JavaScript and deployed in production mode, obfuscating and minifying the code. * **Code Signing:** Expo supports code signing through Apple and Google Play stores to ensure that apps deployed to devices are not tampered with. **Data Storage:** * **Secure Local Storage:** If it's required that we store any sensitive information on a user‘s device, Gather will use Expo’s secure storage provider (`expo-secure-store`) for this (e.g., tokens, credentials). This data is stored in encrypted form, leveraging the OS's secure storage APIs. **App Updates & Security:** * **Over-the-Air (OTA) Updates:** Expo allows for over-the-air updates via its `expo-updates` feature. These updates are signed and verified to prevent tampering. This ensures that only authorized updates are pushed to user devices. * **Fallback Mechanisms:** Expo provides fallback mechanisms to prevent the app from crashing during an OTA update or if an update fails to download correctly. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.joingather.org/security-and-data-privacy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.