# Security operations

## Secrets

Rotate `JWT_SECRET`, `PII_ENCRYPTION_KEY`, `PII_PEPPER`, Mongo, SendGrid, Google, and AWS keys after any suspected leak. Do not commit `.env`.

Production refuses the default `JWT_SECRET` and `SEED_ADMIN_PASSWORD=Admin@123`.

## PII encryption keys

`PII_ENCRYPTION_KEY` is 32 bytes, base64-encoded. `PII_KEY_ID` is stored on each ciphertext (`kid`).

To rotate:

1. Generate a new key and a new `PII_KEY_ID`.
2. Keep the old key available until `node scripts/migrate-pii.js` has rewritten every document.
3. Point `PII_ENCRYPTION_KEY` / `PII_KEY_ID` at the new values, then re-run the migration (dual-read still decrypts leftover plaintext).

`PII_PEPPER` is used only for `nameHash` / `mobileHash`. Changing it requires recomputing hashes.

## AWS S3

- Block public access on the bucket.
- IAM: `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject` on `onboarding/*` only.
- Screenshots use SSE-S3. The API issues a GET URL that expires in `S3_PRESIGN_TTL_SEC` (default 10 minutes).
- To revoke a leaked URL before expiry, delete or replace the object (new key). Then run `node scripts/migrate-s3.js` for leftover local files.

## Sessions

Access JWT lives in the `vpr_access` httpOnly cookie (~15 minutes). Refresh token lives in `vpr_refresh` (7 days) and is hashed in Mongo. Logout and user disable revoke refresh sessions.

## Retention

Settings → “Delete rejected/unpaid after (days)” (default 365). A daily job at 03:15 (`APP_TIMEZONE`) deletes matching onboarded rows and their S3 objects. Confirmed patients are never auto-deleted.

## Audit

Super Admin → Audit log. Events: login success/failure, screenshot view, onboarding confirm/reject, report export, user disable. No patient names or mobiles are stored.

## Legal

Treat onboarded records as personal + health data under the DPDP Act. Keep a DPA with AWS. Limit who may export reports.