🏠 Overview › 🎯 Features ›🎯 Security & Encryption Infrastructure

Security & Encryption Infrastructure

Feature Detail

high complexity extracted Infrastructure & Platform Confidence: 100%
0
Components
58
Shared
0
User Stories
Yes
Analyzed

Description

This feature provides the core security primitives that all sensitive data handling in the app depends on: an encryption service for at-rest data protection, a secure storage layer for credentials and tokens (using flutter_secure_storage backed by Keychain on iOS and Keystore on Android), and an audit log repository that records security-relevant events. This infrastructure underpins BankID/Vipps authentication, JWT token management, encrypted assignment dispatch, and biometric credential storage.

User Flow

Security & Encryption Infrastructure user flow
Click to expand

Analysis

Business Value

The organizations handle highly sensitive personal data including health information, home visit records, and encrypted assignment details containing names, addresses, and medical summaries. GDPR compliance and the trust of both members and partner organizations depend on robust security infrastructure. A centralized encryption and secure storage layer ensures that credentials are never stored in plaintext, that sensitive fields are encrypted at rest, and that all security events are auditable. This infrastructure also enables the encrypted assignment dispatch feature required by Blindeforbundet, which is a hard blocker for that organization's adoption.

Implementation Notes

Secure credential storage uses flutter_secure_storage which delegates to iOS Keychain and Android Keystore, ensuring OS-level hardware-backed protection. JWT access and refresh tokens are stored exclusively in secure storage, never in SharedPreferences or local SQLite. The encryption service wraps AES-256-GCM for symmetric encryption of sensitive fields, with keys derived per-user and stored in secure storage. The audit log repository writes to a dedicated Postgres table with tamper-evident append-only semantics. End-to-end encryption for assignment dispatch uses asymmetric keys (RSA-OAEP or X25519) with public keys stored server-side and private keys in device secure storage.

Components (58)

Shared Components

These components are reused across multiple features

Infrastructure (20)

infrastructure JWT Infrastructure medium Shared infrastructure JWT Infrastructure low Shared infrastructure Auth Middleware medium Shared infrastructure Report API Middleware low Shared infrastructure Report Access Guard low Shared infrastructure Approval Audit Logger low Shared infrastructure End-to-End Encryption Infrastructure high Shared infrastructure Email Delivery Infrastructure low Shared infrastructure Invitation Token Infrastructure medium Shared infrastructure Signed URL Provider low Shared infrastructure Multi-Tenancy Infrastructure high Shared infrastructure Calculator Export Infrastructure medium Shared infrastructure Request & Response Interceptors high Shared infrastructure Design Token System medium Shared infrastructure Semantic Labels Infrastructure medium Shared infrastructure Connectivity Infrastructure low Shared infrastructure Local Database Infrastructure high Shared infrastructure Secure Storage Infrastructure medium Shared infrastructure Connection Pool Infrastructure medium Shared infrastructure Database Migration Infrastructure medium Shared

User Stories

No user stories have been generated for this feature yet.