# Security implementation notes

## Implemented controls

- Stateful Sanctum admin authentication with CSRF-protected login/logout.
- Optional TOTP 2FA, disabled by default as requested.
- Permission-based RBAC plus clinic-level scope on sensitive operational records.
- Active-user checks and server-side authorization on admin routes.
- Public/applications/contact/login request throttles.
- Private filesystem handling for CVs and participant consent documents; downloads require authorization.
- Server-side HTML sanitization for CMS/news/study rich content.
- SVG excluded from CMS media uploads to avoid serving active SVG content directly.
- Validation of study/location/questionnaire relationships.
- Concurrent-safe `BIO-###` sequence allocation and database uniqueness constraints.
- Participant-email/application deduplication controls.
- Activity logs for core study, location, participant and security-relevant operations.
- Integration outbox rather than synchronous third-party calls from participant transactions.
- SMTP password encrypted through Laravel application encryption and masked in admin responses.
- Production configuration keeps debug disabled and secrets out of source control.

## Deployment responsibilities

Before handling live clinical participant data, the organisation should complete an independent penetration/security review, privacy/DPIA review, backup/restore test, infrastructure hardening, TLS/WAF configuration, malware scanning strategy for uploaded documents, secrets-management setup and incident/breach-response procedure.

Private local storage is suitable for a single-server deployment, but a production multi-server environment should use a private encrypted object store with least-privilege credentials. Public media can remain on a separately served public disk/CDN.

The code contains retention infrastructure but intentionally does not auto-delete participant records until the organisation defines and approves the applicable UK/US/protocol retention policy.