| Asset |
Risk |
Priority |
| Linode root access / SSH keys |
Full compromise |
Critical |
| EspoCRM + supplier/buyer data |
Data breach / loss |
Critical |
| n8n workflows + credentials |
Credential theft, workflow tampering |
High |
| Email accounts |
Phishing / account takeover / spam reputation |
High |
| Traefik / TLS certs |
Man-in-the-middle, route hijack |
High |
| Backups |
Ransomware / data loss |
Critical |
| Supplier intellectual property (dossiers, quotes, pricing) |
Confidentiality |
High |
| GDPR/UK GDPR: EU/UK buyer personal data |
Fines / reputation |
Medium-High |
SSH & access
Network & firewall
Traefik / TLS
- Never commit secrets to git.
.env files, API keys, DB passwords, SMTP creds, OAuth tokens → secrets manager.
- Store in n8n credential store / environment variables; for code, use a
.env loaded from a private location with .gitignore.
- Rotate keys; use least-privilege API keys (e.g., a dedicated read-only EspoCRM API key for n8n).
- For the AI layer: LLM API keys in the secrets manager; audit via Langfuse.
| Dataset |
Method |
Frequency |
Retention |
Restore test |
| EspoCRM database (MySQL) |
mysqldump / pg_dump (if migrated) |
Nightly |
7–30 days |
Quarterly |
| EspoCRM file storage (uploads) |
rsync/tar to offsite |
Nightly |
7–30 days |
Quarterly |
| n8n workflow DB (Postgres) |
pg_dump |
Nightly |
7–30 days |
Quarterly |
| Postgres (future supplier DB) |
pg_dump |
Nightly + WAL |
7–30 days |
Quarterly |
| Config (Traefik, compose, .env) |
git + encrypted copy |
On change |
long |
— |
| Uploaded docs (certs, QC, invoices) |
object storage (S3-compatible) |
Nightly |
30+ days |
Quarterly |
- 3-2-1 rule: 3 copies, 2 media, 1 offsite. Offsite to S3-compatible object storage (e.g., Backblaze B2, Linode Object Storage, Wasabi) — cheap and reliable.
- Test restores on a schedule — an untested backup is not a backup.
- Encrypt backups at rest; protect backup credentials.
- EspoCRM: keep patched; enable 2FA for admin; enforce strong passwords; apply least-privilege Roles/ACL (agents see only their data).
- Webhooks (n8n inbound, EspoCRM): validate signatures / secrets; never trust unauthenticated webhooks.
- Input handling: sanitize any user-supplied data that flows into scrape→LLM→SQL; beware prompt injection from scraped web content (treat scraped text as untrusted).
- API keys/endpoints: rate-limit public APIs; log auth failures.
SupplyShore may process personal data of EU/UK buyers (names, emails, phones). Obligations:
- Lawful basis for processing (contract/legitimate interest); document it.
- Data minimization: collect only what's needed.
- Data Subject Rights: ability to access, correct, erase (EspoCRM supports this — implement the process).
- Records of processing + privacy notice on the website.
- DPA with any processor (email host, LLM/cloud providers) that handles personal data.
- AI & PII: don't send unnecessary PII to third-party LLMs; prefer providers with EU/UK data-residency or contractual DPAs; anonymize where possible.
- Supplier data (business info, not consumer PII) is generally lower-risk but treat confidential commercial data carefully.
- Uptime: simple external monitor (UptimeRobot/Uptime Kuma) on
crm.supplyshoreltd.com and app endpoints.
- Logs: enable + rotate Traefik access logs, EspoCRM, n8n; centralize to a log file or n8n→notification on errors.
- AI tracing: Langfuse for LLM calls (cost + correctness + safety).
- Alerts: n8n/notification hub → Telegram/Slack for: disk usage, failed backups, failed workflows, auth failures, cert expiry.
- Incident response runbook: define who to contact, how to take a snapshot, how to restore from backup, and how to rotate credentials. Snapshot the Linode before any risky change.
¶ 10.8 Secrets & Credential Inventory (create & maintain)
Maintain a private inventory (NOT in this repo): Linode root/admin, EspoCRM admin + API keys, DB creds, email IMAP/SMTP creds, n8n admin + credential store, LLM/API keys, backup storage keys, domain/DNS registrar.
- Portainer — safe container management (avoid arbitrary
docker exec).
- Keycloak — add central SSO/2FA when multiple apps exist (Phase B/C).
- SpiderFoot — optional recon of your own exposed services (self-assessment).
- Keep attack surface small: fewer exposed ports, patched images, minimal installed packages.