Security Architecture & Sanitization

Security and tenant isolation are core pillars of Ticket2Doc. Because MSP tickets often contain sensitive network information, Ticket2Doc enforces strict in-memory sanitization rules.

1. In-Memory Secret Sanitization

Raw resolution notes are scrubbed before reaching any external LLM model. Sanitization strips:

• IP Addresses: IPv4 and IPv6 matches replaced with [REDACTED_IP].
• User Passwords & Secrets: String patterns following pass:, password=, secret:, or high-entropy tokens replaced with [REDACTED_SECRET].
• Private Domain Names: Internal FQDNs replaced with [REDACTED_HOST].

2. Cryptographic Storage

• API Token Storage: Hudu API tokens and webhook secrets are encrypted using AES-256 Fernet symmetric encryption.
• Key Isolation: Encryption keys are derived per tenant and stored separately from database instances.

3. Account Access Security

• Multi-Factor Authentication (MFA / TOTP) required for portal administrators.
• Immutable event logs record every API call, webhook payload status, and SOP generation timestamp.