ARCHITECTURE · SECURITY MODEL
The security model.
The fabric is single-tenant at the data layer regardless of deployment model. Tenancy isolation, encryption, and access control are designed to assume any of them could be compromised at the layer above:
Defense posture
- Encryption — TLS 1.3 in flight; AES-256 at rest with customer-managed keys (AWS KMS / GCP CMEK / Azure Key Vault). Detection plans and IOC bundles are signed with Ed25519.
- Tenant isolation — each customer is a logical cell with its own KMS key, IAM role chain, and per-cell network. No shared S3 prefixes, no shared compute pools, no cross-cell IAM permissions.
- Access — RBAC with SCIM-provisioned groups, mandatory MFA, optional break-glass with dual approval. All admin actions land on the fabric as events you can query like any other.
- Defense in depth — production access is via short-lived SSO; every console session is recorded; every privileged action is replayable; key rotation is automatic; revocation is global within 60 seconds.
Key management
| Layer | Mechanism |
|---|---|
| In flight | TLS 1.3, mutually authenticated between collectors and the fabric |
| At rest | AES-256 with customer-managed keys (AWS KMS / GCP CMEK / Azure Key Vault) |
| Plans & IOC bundles | Signed with Ed25519; verified before load |
| Rotation | Automatic; global revocation propagates in < 60 s |
Access control (RBAC)
Roles are SCIM-provisioned from your IdP with mandatory MFA. Privilege is least-by-default; elevation is time-boxed and dual-approved.
| Role | Can | Typical holder |
|---|---|---|
| Viewer | Read cases, events, dashboards | Auditor, executive |
| Analyst | Triage, investigate, run safe (reversible) actions | SOC tier 1–2 |
| Responder | Approve and execute containment, run playbooks | SOC tier 3, IR |
| Admin | Manage connectors, policy, and RBAC | Platform owner |
| Break-glass | Time-boxed elevated access, dual approval, fully recorded | On-call lead |
Tenant isolation
Every customer is a logical cell: its own KMS key, IAM role chain, storage prefix, and network. There are no shared tables, compute pools, or cross-cell permissions, so a failure or compromise at the layer above a cell cannot reach another tenant's data.
The full security program (penetration tests, SOC 2 Type II / ISO 27001 / FedRAMP scope, subprocessors, data-residency map) lives in the Trust Center.