Threat model
The most valuable assets are tenant isolation, legal/configuration integrity, consent/rights proof, incident clocks, connector authority, evidence, customer keys and the ability to act during a deadline. Threat actors include external attackers, malicious Principals, compromised tenant admins, insiders/support, supply-chain attackers and compromised customer systems.
Trust zones
Section titled “Trust zones”Public portal/API; tenant console; support plane; application/workers; database/object/evidence; KMS/secrets; customer connector agent; customer systems; notification/provider and authority interfaces; build/release pipeline.
flowchart LR A[External attacker] --> P[Public portal / API] U[Principal] --> P TA[Tenant admin] --> C[Tenant console] S[Support operator] --> SP[Support plane] P --> APP[Application services] C --> APP SP --> APP APP --> DB[(Tenant data)] APP --> EV[(Evidence store)] APP --> KMS[KMS / secrets] APP --> AG[Customer connector agent] AG --> CS[Customer systems] APP --> NP[Notification / authority interfaces] SC[Supply-chain attacker] --> CI[Build / release pipeline] CI --> APP
Trust is re-established at every arrow through identity, tenant scope, purpose/capability, message integrity, freshness and audit. Being inside a customer network or cluster is not sufficient trust.
Threat register
Section titled “Threat register”| Threat / STRIDE | Attack | Prevent/detect/respond |
|---|---|---|
| cross-tenant access / E,I | alter tenant ID/object path/cache key | server-derived tenant, composite keys/RLS, scoped object/queue, negative tests, anomaly alert |
| Principal impersonation / S,I | enumerate account, steal OTP/session, forge representative | non-enumerating response, risk-based step-up, rate/device signals, manual checker, session binding |
| malicious tenant admin / E,T | mass export, backdate consent, release hold | granular roles, step-up, maker-checker, append-only original timestamps, export limits/alerts |
| forged consent / S,T,R | client submits false action/notice | approved version, channel proof, idempotency, signed SDK context, immutable linked receipt, dispute workflow |
| replayed withdrawal/webhook / T | duplicate/stale signed request | timestamp window, unique delivery/event ID, nonce/idempotency, aggregate sequence |
| connector compromise / S,T,I,E | arbitrary query, exfiltrate secrets/PII | signed capability package/instruction, no arbitrary code, egress allow-list, sandbox, short tokens, revoke/attest |
| insider/support / I,R | browse cases or evidence | JIT scoped support grant, customer approval, session recording metadata, dual control, honey/audit alert |
| evidence tampering / T,R | edit/delete audit or replace artefact | append-only events, hash chain, KMS-signed roots, WORM export, verification |
| deletion evasion / T,R | mark complete without deleting; restore old copy | destination verification, partial certificate, backup tombstones, restore test, independent sample |
| notification suppression / T,D | close clock, disable channel, hide population | immutable awareness/clock, separate approver, deadline alerts, delivery reconciliation, executive escalation |
| mass export / I,D | abuse rights/audit export | scoped query, row/size caps, two-person + step-up, watermark/manifest, async monitored job |
| supply chain / T,E | compromised dependency/image/connector | pinned lock, review, SAST/SCA/secret/IaC/container scans, SBOM, provenance/signature, isolated build |
| support impersonation / S | fake support obtains credentials/evidence | no secret request policy, verified in-product support, phishing-resistant MFA, customer callback |
| child/guardian fraud / S,I | false parent or account takeover | relationship assurance ladder, change/expiry review, conflict handling, minimal evidence |
| deadline availability / D | DDoS/ransomware during six/72-hour clock | multi-region/tier resilience, offline runbook/templates/contacts, WAF/rate limit, manual authority fallback |
| legal-config compromise / T | activate fake source or country rule | signed reviewed bundles, maintainer/reviewer separation, customer activation, transparency diff |
| inference from metadata / I | use subject/consent graph for profiling | purpose-bound access, pseudonymous refs, aggregation thresholds, no unrelated telemetry/ads |
Privacy abuse cases
Section titled “Privacy abuse cases”- A customer searches every rights case to identify activists or complainants.
- A provider mines consent/withdrawal rates for unrelated sales scoring.
- An employer enables a generic connector to infer productivity.
- Support copies incident/health evidence to a ticket or AI assistant.
- A “legal hold” is created broadly to avoid deletion.
- Identity assurance accumulates Aadhaar/PAN documents beyond the result.
- Child mode is bypassed through an analytics subdomain or mobile SDK.
Mitigations combine product non-goals, purpose/role policy, approval, PII budgets, audit review and contract. Controls are tested against the abuse, not merely documented.
High-risk flows
Section titled “High-risk flows”Mass export
Section titled “Mass export”Request → preview count/categories → policy and entitlement → step-up → checker → async scoped generation → encrypted expiring package → recipient verification → download limit → manifest/audit.
Break glass
Section titled “Break glass”Declared incident and reason → phishing-resistant authentication → time-limited least scope → immediate alert → session/action audit → automatic revoke → post-use review within one business day. Break glass cannot disable audit.
Connector deletion
Section titled “Connector deletion”Signed exact instruction → policy/expiry/replay check → deterministic selection preview/count → approved execution → verification query → digest/outcome → reconciliation. No arbitrary SQL from the control plane.
Security test cases
Section titled “Security test cases”- mutate tenant/resource identifiers across every transport and background job;
- replay signed webhook/agent instruction inside and outside skew window;
- race two resource versions and confirm one conflict;
- inject Mermaid/Markdown, CSV formulas, SQL/NoSQL, template and log payloads;
- exfiltrate through connector error, trace, dead letter and support export;
- restore backup and prove tombstone reapplication;
- compromise notification provider and verify content/recipient limits;
- deny control plane during incident and execute offline/manual runbook.
Threat review is quarterly and triggered by a new deployment profile, connector capability, identity method, statutory interface or major incident.