Security
A database dump exposes nothing.
Every user's personal data is encrypted at rest with per-tenant keys that never touch the database. A leaked storage credential or a stolen backup yields ciphertext, not emails, not names, not phone numbers.
- OAuth 2.0
- OIDC
- SAML 2.0
- SCIM 2.0
- PKCE (RFC 7636)
- PAR (RFC 9126)
- WebAuthn / FIDO2
- TOTP
- JWT / JWKS
- AES-256-GCM
- HMAC-SHA256
- TLS 1.2+ / 1.3
- RBAC
- DDoS / WAF
- SOC 2 CC6 / CC7
- GDPR erasure
- 01Stolen database or backup
Ciphertext. Per-tenant keys live in Vault, never in the database.
- 02Leaked storage credential
Nothing usable. Shared keys are off; access is Entra identity + RBAC only.
- 03Compromised app pod
No lateral movement, no cloud metadata. Egress is default-deny and every decrypt is logged.
- 04Internet scan of the admin plane
No route. The control plane is not on the public internet.
- 05Traffic interception
TLS end to end, including pod-to-Vault inside the cluster.
Layers, not a wall
Each boundary an attacker crosses only leads to the next one. At the center, the data itself is ciphertext.
Encryption & tenant isolation
Personal data is encrypted at rest with keys the database never sees, and it stays searchable.
- Keys outside the data
- Values encrypt and decrypt through HashiCorp Vault Transit. The application never holds key material and the database never sees a key.
- A key per tenant
- Every tenant gets its own AES-256-GCM key. Encryption is randomized, so identical inputs never produce identical ciphertext.
- Searchable without plaintext
- Keyed-HMAC blind indexes power login-by-email, search-by-name and domain lookups over data that is never stored in the clear. The index keys are HMACs too, so a dump of the index tables reveals nothing.
- Crypto-shredding
- Deleting a tenant destroys its key, making all of that tenant's data permanently unrecoverable. That is GDPR Article 17 erasure by cryptography, with no row-by-row deletion.
- What is protected
- Emails, names, phone numbers, company names and custom attributes are encrypted at rest. Passwords were never stored reversibly. Opaque IDs, roles and timestamps stay clear so the system stays operable.
Key management
The keystore is treated as the crown jewels, because it is.
- Encrypted in the cluster
- Vault's listener runs TLS with a private CA, so Transit traffic is encrypted even on the pod network.
- KMS auto-unseal
- Vault auto-unseals against an Azure Key Vault key. No unseal keys sit on disk or in a runbook.
- HA and backed up
- A three-node Raft cluster with a daily snapshot to an isolated, geo-redundant (GRS) account, roughly a 24h RPO. Snapshots are barrier-encrypted.
- No root in the cluster
- Apps run on scoped, least-privilege per-host tokens. The root token lives in a break-glass vault, not the workload.
- Every operation audited
- A Vault audit device records every cryptographic operation by token and key. Use of a token outside its policy raises an alert.
Network & zero-trust
Every hop is deny-by-default. A workload can reach only what it is declared to need.
- Default-deny both ways
- NetworkPolicies deny pod-to-pod ingress and egress by default. A compromised pod cannot move laterally, reach cloud metadata, or exfiltrate freely.
- Edge and origin lock
- The public surface sits behind Cloudflare for DDoS and WAF, and the origin only accepts traffic from the edge. Direct-to-origin is blocked.
- Private data plane
- Storage, Key Vault and the container registry are reached over private endpoints, and the Kubernetes API is private.
- Admin off the internet
- The platform control plane is reachable only over the private network, never the public internet.
Identity & access
The standards you already require, plus phishing-resistant options for the accounts that matter.
- OAuth2 / OIDC, done right
- Authorization Code with PKCE (RFC 7636) and Pushed Authorization Requests (RFC 9126), so authorization parameters never ride the browser. Tokens are JWTs verified against rotating JWKS.
- Enterprise federation
- SAML 2.0 sign-in and SCIM 2.0 provisioning (RFC 7643/7644), including group-to-role mapping at token issuance.
- MFA and passkeys
- TOTP, WebAuthn / FIDO2 passkeys and fully passwordless sign-in, with refresh-token rotation on every use.
- Hardened admin
- Platform admin is SSO-only through Entra SAML under enforced MFA. There is no admin password to phish.
Operations & assurance
Controls you can audit, not just claims you can read.
- Audit log with alerting
- Security-relevant events are logged and alerted on, aligned to SOC 2 CC7 monitoring.
- Images scanned in CI
- Every container image is scanned for CVEs, and a High or Critical (CVSS) finding blocks the release.
- Rotation and patching
- Static secrets rotate on a documented cadence and dependency security updates land automatically.
- Hardened infrastructure state
- Infrastructure state is geo-redundant, versioned, soft-deletable, private, and reachable by identity only, with no shared keys.
The threat we designed against
Every provider claims "encrypted at rest." Almost always that means disk encryption, which the cloud decrypts automatically for anything allowed to read the store, so a leaked storage key or a stolen backup still spills plaintext. Ours doesn't. The keys live in Vault, never in the database, so the data and the key that opens it are never in the same place. Copy the tables and all you get is ciphertext, worthless without a second break-in to Vault.
One honest caveat about "nothing": that means your users' personal data. The audit trail and short-lived diagnostic logs still record what happened and when, so the system stays operable and accountable. Every identity in them is a pseudonym or a masked token, never a raw name, email, or IP address.
Reporting a vulnerability
Found something? Email [email protected]. Our machine-readable contact is published at /.well-known/security.txt.
