Security at Navvi One

Identity and access

Navvi APIs use Navvi-issued session tokens rather than accepting Microsoft, Google or integration-provider access tokens as application credentials. Tenant membership and role are resolved from the authenticated Navvi session. Permission checks protect administrative integration actions, and tenant identity is not accepted from browser-supplied tenant identifiers.

Tenant boundaries

Tenant-scoped data access applies the authenticated tenant context. Navvi maintains tenant-isolation tests and CI checks intended to prevent new unscoped repository access. This is an ongoing engineering control, not a claim that every possible security risk has been eliminated.

Zoom Workplace connection controls

• Only a Navvi tenant administrator with the integration-configuration permission can initiate, reconnect or disconnect Zoom authorization.
• OAuth uses durable, single-use state and a Secure, HttpOnly, SameSite=Lax browser nonce. Administrator permission is revalidated during callback processing.
• The Zoom account identifier is discovered from an authenticated Zoom API response. Email and phone values are not used to infer tenant ownership.
• One Zoom account per app namespace is enforced. Connection lifecycle controls prevent work from an earlier authorization from being applied after reconnect or disconnect.
• OAuth credentials are encrypted using AES-256-GCM with a versioned keyring. Refresh-token updates are serialized to prevent conflicting changes.
• Navvi-controlled telemetry and logs redact OAuth callback query parameters. External Azure/App Service logging checks passed using synthetic code and state markers.
• Disconnect revokes credentials and preserves account reservation and lifecycle history. Removal of an unused connection is separate, audited and permitted only when no Zoom business dependencies exist.
• The removal audit is completed with the lifecycle change and stores a fingerprint, not raw credentials.

Current Zoom Workplace boundary

The approved near-term permission set supports organization-level account authorization, Zoom user-directory synchronization and Zoom Phone user and call-history access. User synchronization and Zoom Phone activity logging remain in development and are not currently available production functionality. The requested capability set excludes recordings and audio or video content, recording transcripts, AI call summaries, voicemail content, Zoom Meetings data, chat or message content, and Zoom Surface, Embed or Connect capability.

Application and infrastructure controls

Navvi uses HTTPS for production services, encrypted credential storage, private tenant document storage, authenticated short-lived document access, input sanitization for stored HTML, provider verification for configured inbound webhooks, rate limiting, security-oriented response headers, and structured security and audit logging. Content Security Policy is currently report-only, and broader network hardening remains ongoing.

Security validation

Security-relevant changes are supported by code review, automated tests, tenant-isolation checks, dependency review and targeted integration tests. Navvi also operates a static application security testing (SAST) program using Semgrep Community Edition across Python, JavaScript, TypeScript and React, supplemented by Bandit for Python. These checks run in GitHub Actions for pull requests to main, pushes to main, a weekly schedule and on-demand runs.

Navvi does not currently operate a formal dynamic application security testing (DAST) program or periodic third-party penetration testing. Navvi does not claim SOC 2 or ISO 27001 certification.

Report a vulnerability

Please do not publish a suspected vulnerability. Send reproduction details to support@navvi.one. Do not include passwords, tokens, private keys or sensitive customer data in the initial message.