Security architecture

All traffic between clients and the platform travels over TLS 1.3. TLS 1.2 is the minimum accepted version; older protocol versions are rejected at the load balancer. HTTP requests are redirected to HTTPS.

Data stored on disk — including database records, backups, and log archives — is encrypted using AES-256 with keys managed separately from the data. Encryption is applied before data leaves application memory.

Each client's data is stored in a logically isolated partition. Row-level security policies in the database enforce tenant boundaries at query time — a misconfigured query cannot return data belonging to another tenant.

No data is shared across client accounts for any purpose, including analytics or model training. Cross-tenant access is architecturally prevented, not merely policy-controlled.

Encryption keys follow an envelope-encryption model: a data encryption key (DEK) encrypts each record; the DEK is itself encrypted by a key encryption key (KEK) managed in AWS Key Management Service (KMS) in the us-east-1 region.

KEKs are rotated annually. The plaintext DEK exists only in memory during active processing and is never written to storage.

Multi-factor authentication is required for all accounts with administrative or privileged access to the platform. Shared credentials are not permitted.

Access is granted on a least-privilege, role-based model. Roles are reviewed quarterly; access is revoked within one business day of a personnel change.

Every authentication event, privilege change, data access, and administrative action is logged to an append-only log store. Log records cannot be modified or deleted.

Logs are retained for seven years and are protected by integrity hashes. Any tampering attempt is detectable by re-verifying the hash chain.

All public endpoints sit behind a web application firewall that inspects HTTP/S traffic and blocks requests matching known attack patterns, including OWASP Top 10 categories.

Distributed denial-of-service mitigation is active at the network layer. Anomalous traffic volumes trigger automatic rate limiting before reaching application infrastructure.