CYBERSECURITY FEATURES & CONTROLS

Project Atrium · Prepared for Hyatt Security Review
v1.0 · 2026-05-30
project-atrium.com

Project Atrium implements a layered security model spanning authentication, authorisation, data protection, AI governance, and audit logging. The platform is hosted on Emergent Labs infrastructure (Kubernetes, MongoDB, object storage) with all customer data encrypted in transit (TLS 1.3) and at rest. The application layer adds enterprise-grade controls listed below — each designed to satisfy Hyatt's vendor-security policy without sacrificing usability.

1 · Authentication & Identity

🔐 JWT-based session tokens

Every authenticated request carries a signed JSON Web Token in the Authorization header. Tokens expire on a sliding window and are validated server-side on every API call.

🔑 Bcrypt password hashing

User passwords are stored as bcrypt hashes (industry standard, salted, configurable work factor). Plaintext passwords are never logged or persisted.

📧 Self-service email change with 6-digit verification

Email changes require a 6-digit code delivered via Resend to the new address. Codes expire after 10 minutes; attempt limit triggers a lockout. All collections referencing the old email are updated in a single MongoDB transaction.

🚪 Admin force-change override

Administrators can override the verification flow for emergency account recovery (e.g. departed employee), with the action logged to email_change_log.

2 · Authorisation (Role-Based Access Control)

Two-tier RBAC with strict hierarchy

👑 Engineer — top tier

Highest Full admin powers PLUS exclusive ability to manage other engineers. Only an engineer can promote/demote another engineer; admins receive a 403 response.

⚙️ Admin / Ownership / Top Leader

Privileged Full administrative access to the CMS, users, and settings. Ownership and Top Leader roles are silenced from automated outbound communications by default.

✏️ Editor

Limited Edit access to assigned department(s) only. Subject to per-tile padlocks for non-assigned departments.

👁️ Viewer

Read-only View-only access to assigned content. Cannot trigger any write or AI operation.

Department-level gating (Tier B)

3 · Data Protection in Transit & at Rest

🌐 TLS 1.3 end-to-end

All browser-to-server traffic flows over HTTPS with TLS 1.3 at the Emergent Kubernetes ingress. No mixed-content paths exist in the codebase.

🗄️ MongoDB encryption at rest

Customer data (users, areas, tasks, events, etc.) is stored encrypted at rest by the underlying database tier.

📦 Object storage encryption

Uploaded photos, videos, CAD drawings, and PDFs are stored in Emergent's object storage layer, encrypted at rest. Persistent URLs survive container restarts and redeployments.

🛡️ XSS / injection guards

URLs in tile-link attachments reject javascript: and data: schemes server-side. User-submitted HTML is rendered with React's default escape rules (no dangerouslySetInnerHTML on user content).

4 · AI Governance Layer

All AI calls flow through a dedicated ai_governance.py module that enforces four independent controls before any prompt leaves the perimeter.

🔴 Master AI kill-switch

One administrator toggle disables every AI endpoint platform-wide. Returns HTTP 503 with a clean user-facing message. Use during legal review, incident response, or vendor onboarding.

🎛️ Per-feature toggles (10 features)

Independently disable any of: chat, image generation, deep research, CapEx, training creator, avatar generation, photo enhancement, department assistants, transcription (Whisper), text-to-speech.

🕵️ PII Scrubber

Regex-based server-side stripping of guest emails, phone numbers, room/suite/villa numbers, credit-card-shaped digit runs, and two-word capitalised names from prompts before they leave the backend. Defence-in-depth on top of provider DPAs. Live paste-test playground in admin.

🔑 Bring-Your-Own Keys (BYO) mode

Each user can register their own OpenAI / Anthropic / Gemini API keys via Profile → AI Credentials. Admins can enforce BYO-required globally — AI calls without a user-provided key are rejected (HTTP 412). Routes Hyatt's AI traffic under Hyatt's own enterprise contracts.

Upstream provider policy

Note: When using Emergent's Universal LLM Key (default), requests are sent under Emergent's account, not Hyatt's. Confirmation of Emergent's contractual-layer commitments (DPA, zero-retention) is being requested separately — see Emergent Procurement Email document.

5 · Privacy Controls for End-Users

🙈 Hide-from-public-team toggles

Each user can independently hide their email address and/or phone number from the public "People behind the rebuild" team card. Admins and engineers always see the real values.

🎭 Executive contact restrictions

Specific high-profile contacts (Pedro Pereira, Dwight Tabales, etc.) have their phone numbers and emails server-side scrubbed from non-privileged API responses. Cannot be unlocked from the frontend.

6 · Audit Logging

📜 Email audit trail (email_log)

Every email sent through the platform (invitations, verification codes, task notifications, password rotations) is logged with timestamp, recipient, status, provider ID, and any error. Default retention: 1 year.

📋 Email-change audit (email_change_log)

Every email change — self-service or admin force-change — appends an immutable row capturing actor, old email, new email, timestamp, and method.

🔍 AI settings audit footer

The Admin → AI Settings page displays the last-changed timestamp and the administrator who made the change, on every load.

📊 Activity timeline on tasks

Each task in the project-management module carries a chronological activity log of status changes, assignee updates, comments, and attachments.

7 · Email & Notification Security

8 · Operational Safeguards

🚦 Rate limiting at ingress

Emergent's Kubernetes ingress enforces per-IP request limits to mitigate brute-force and scraping attacks. [FILL: Specific rate-limit thresholds — to be confirmed with Emergent support.]

🔄 Idempotent admin operations

Bulk user-creation (Sync from Team), role changes, and content imports are idempotent — re-running never duplicates records or overwrites existing accounts.

⚠️ 503/412 error semantics

AI endpoints return 503 when disabled and 412 when BYO is required but missing — semantically distinct from generic 4xx/5xx so the frontend can render clear messages instead of dumping raw stack traces.

🧪 Linting & type checks in CI

Backend (Python/Ruff) and frontend (ESLint) checks run on every build; backend startup is gated by import validation. Reduces deploy-time risk of broken endpoints.

9 · Items Pending Confirmation

The following items depend on Emergent Labs' enterprise compliance package and will be filled in as documentation arrives: