Security architecture
Security defaults apply to managed and self-hosted profiles. Customer-controlled deployments can replace providers but not remove tenant checks, audit or secure defaults without an explicit unsupported fork.
Cryptography and keys
Section titled “Cryptography and keys”- TLS 1.3 preferred, TLS 1.2 controlled minimum; mTLS for agents/high-trust service paths.
- Envelope encryption: data encrypted with DEKs; DEKs wrapped by KMS/HSM KEKs.
- Dedicated tenant key where threat/regulatory tier justifies; separate environment and purpose keys.
- Field encryption for restricted free text, nominee/identity evidence and integration metadata.
- Customer secrets stored in external secrets manager; database stores a reference.
- Automated rotation with overlap, versioned decrypt, revocation and recovery test.
- No custom crypto; algorithms/providers follow current approved organisational baseline.
Hashing does not anonymise an identifier. Subject references use tenant-secret HMAC; passwords, if any local emergency account exists, use a current memory-hard password hash and phishing-resistant MFA.
Identity and authorization
Section titled “Identity and authorization”Federated SSO, SCIM, MFA, session/device/risk policy, short-lived service tokens and mTLS workload identity. RBAC establishes job role; ABAC/context adds tenant/entity, assignment, sensitivity, purpose, support grant and action risk. Privilege is just-in-time with expiry. Quarterly access certification and immediate joiner/mover/leaver events.
Break-glass account is sealed, monitored and tested. No shared admin.
Network and workload
Section titled “Network and workload”Private database/object/queue endpoints; deny-by-default security groups/network policies; egress allow-lists; separate public, worker, support and management paths; WAF/DDoS/rate controls; hardened containers read-only where possible, non-root, dropped capabilities, seccomp and resource limits. On-prem installation documents equivalent controls.
Audit and evidence
Section titled “Audit and evidence”Every authentication, authorization decision for sensitive action, configuration transition, connector instruction/result, export, support session and evidence mutation appends an event. Daily tenant sequence roots are KMS-signed; optional customer WORM export supports independent verification. Audit detail is redacted and purpose-bound; tamper evidence does not justify indefinite PII retention.
Privacy-safe observability
Section titled “Privacy-safe observability”Structured logs use event codes, tenant pseudonym, resource type/random ID, correlation, duration and error class. Never log tokens, headers, request/response bodies, subject source IDs, notice free-text attachments or raw connector errors. Metrics have aggregation thresholds; traces sample and redact. Debug access is time-limited and cannot enable payload logging in production without an approved incident change.
CERT-In log-location/180-day and future Rule 6 one-year controls are configured by log class and purpose. Sector rules can add retention; legal configuration records the source.
Support plane
Section titled “Support plane”Support begins with metadata and health. Customer explicitly grants tenant/entity/case scope, duration and reason. Restricted data needs separate approval. Access uses support identity, not impersonated customer credentials, and alerts the customer. Exports to ticketing/AI tools are redacted and separately approved.
Data loss and exfiltration controls
Section titled “Data loss and exfiltration controls”Export service enforces count/field policy, two-person approval, watermark/manifest, encryption, expiry and download limit. Object storage denies public access and cross-tenant prefixes. Database and queue egress is monitored. Connector agent has a response schema/size budget; unexpected content is quarantined.
Resilience and forensics
Section titled “Resilience and forensics”Immutable backups, isolated recovery credentials, tested PITR, dependency/region failure exercises, incident evidence preservation and clock-synchronised infrastructure. Forensic snapshots are scoped, encrypted, access-controlled and held under an incident/legal record; no routine full- tenant clone to developer environments.
Baseline acceptance
Section titled “Baseline acceptance”- no critical/high threat remains without named risk acceptance and expiry;
- cross-tenant negative suite passes in API, jobs, objects, search, export and restore;
- secrets/PII scan finds none in logs, image layers or repository;
- restore meets tier RTO/RPO and replays deletion tombstones;
- key rotation and revocation succeed without silent data loss;
- offline incident pack works when application and IdP are unavailable.