docuseal/docs/architecture/security-integration.md

Security Integration

Existing Security Measures

Authentication: Devise with database_authenticatable, 2FA support, JWT tokens Authorization: Cancancan with Ability class, role-based via AccountAccess Data Protection: Encrypted fields, secure file storage, CSRF protection Security Tools: Devise security extensions, input validation, secure headers

Enhancement Security Requirements

New Security Measures:

• Token-based Sponsor Access: Unique tokens for sponsor portal (not JWT)
• Institution Isolation: Ensure strict data separation between institutions
• Role Validation: Portal-specific role checks at controller level
• Document Access Control: Verify enrollment ownership before document access
• Bulk Operation Limits: Rate limiting for sponsor bulk signing

Integration Points:

• Authentication: Extend existing Devise setup with cohort-specific roles
• Authorization: Add cohort permissions to existing Cancancan abilities
• Data Protection: Apply existing encryption to new sensitive fields
• Session Management: Use existing session handling for portal access

Compliance Requirements:

• South African Regulations: Electronic signature compliance (existing HexaPDF signatures)
• Data Privacy: POPIA compliance for student personal data (existing GDPR patterns)
• Audit Trail: Document verification actions logged (extends existing audit capabilities)

Security Testing

Existing Security Tests: Devise security tests, API authentication tests New Security Test Requirements:

• Portal Access Control: Test role-based portal access
• Institution Isolation: Test cross-institution data access prevention
• Token Security: Test sponsor token generation, expiration, reuse prevention
• Bulk Operation Security: Test rate limiting and abuse prevention

Penetration Testing:

• Scope: New cohort endpoints and portal authentication
• Focus: Token-based sponsor access, institution isolation, bulk operations
• Tools: Existing security scanning tools, OWASP ZAP for API testing

---