Security, GDPR & Compliance: How We Protect Every Byte

Security isn't a feature you add later. In Cadences, it's an architectural decision that affects every layer of the stack: from how each organization's data is isolated to how a click on a registration button is validated. This article explains the complete security model.

Every request reaching Cadences passes through multiple verification layers before touching a single piece of data:

Cadences uses Cloudflare Turnstile instead of traditional CAPTCHAs. The difference is critical: Turnstile verifies the user is human without interrupting the experience. No puzzles, no "select all traffic lights".

async function verifyTurnstile(token: string, ip: string) {
  const response = await fetch(
    'https://challenges.cloudflare.com/turnstile/v0/siteverify',
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        secret: env.TURNSTILE_SECRET_KEY,
        response: token,
        remoteip: ip,
      }),
    }
  );

  const result = await response.json();

  if (!result.success) {
    throw new Error('Bot detected — request rejected');
  }

  return result;
}

Turnstile is applied on all critical forms: registration, login, contact and payments. The token is verified server-side in the Worker, never on the client.

Cadences supports two distinct authentication flows depending on context:

Not all users have access to the same features. Cadences implements a feature guard system that protects costly APIs and premium functionality:

class PremiumAPIAccessError extends Error {
  constructor(feature: string) {
    super(`Premium feature "${feature}" not available`);
    this.name = 'PremiumAPIAccessError';
  }
}

function requirePremiumFeature(org: Org, feature: string) {
  const allowed = org.plan?.features || [];

  if (!allowed.includes(feature)) {
    throw new PremiumAPIAccessError(feature);
  }
}

// Usage example in Voice AI endpoint
requirePremiumFeature(org, 'voice_calls');
requirePremiumFeature(org, 'elevenlabs_tts');

This is especially important for pay-per-use APIs (ElevenLabs, Twilio, OpenAI). A free plan user cannot generate voice calls no matter how well they know the endpoint URL.

Data isolation in Cadences isn't a software filter — it's an architectural guarantee. Each organization has its own D1 database (SQLite at the edge). There's no WHERE org_id = ? — the entire database belongs to a single tenant.

Every HTTP response from Cadences includes security headers that block attacks before the browser executes malicious code:

// Content Security Policy — controls what the browser can load
Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'unsafe-inline' challenges.cloudflare.com;
  style-src 'self' 'unsafe-inline' fonts.googleapis.com;
  img-src 'self' data: images.unsplash.com *.googleusercontent.com;
  connect-src 'self' *.cadences.app api.elevenlabs.io;
  frame-src challenges.cloudflare.com;

// Other security headers
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(self), geolocation=()

In Electron apps (CadencesLab, Audio Hub), context isolation is also applied: the app code has no direct access to Node.js APIs. All communication goes through a preload bridge with typed IPC.

GDPR compliance isn't achieved with a cookie banner. It's achieved with architectural decisions that enable exercising every right the regulation establishes:

// GDPR Article 17: Right to erasure
await env.CF_API.deleteD1Database(org.dbId);
await env.R2.deletePrefix(`org/${orgId}/`);
await env.KV.deletePrefix(`org:${orgId}:`);
// The entire organization vanishes. No remnants.

Cadences manages dozens of API keys and secrets from external services: Google OAuth, Twilio, ElevenLabs, Stripe, DeepSeek, OpenAI, Anthropic. None of these secrets appear in the source code:

Each organization has its own rate limiting Durable Object. We don't share counters across tenants. This means:

The rate limiter uses a sliding window implemented with Durable Objects. Each org has its own DO, meaning abuse from org A doesn't affect org B (no noisy neighbor problem).

Security in Cadences isn't a checkbox — it's an emergent property of the architecture. Per-tenant isolation isn't a SQL filter, it's a separate database. Anti-bot protection isn't an annoying CAPTCHA, it's invisible Turnstile. GDPR compliance isn't a cookie banner, it's the ability to DROP DATABASE and have everything disappear.

Each layer works independently. If a vulnerability is discovered in Turnstile tomorrow, the other 6 layers keep protecting. If a JWT is compromised, the rate limiter and feature guards still block unauthorized access. Defense in depth isn't a buzzword — it's the only serious way to build software in 2026.

The best security is the kind users don't notice but attackers can't overcome.