Security architecture

This page answers the hosting, encryption, identity and data questions in public-sector RFPs. Hosting regions, backups, uptime, penetration testing and notification times are proposed service terms, confirmed in each contract.

Hosting

Single tenant per database: each customer gets its own application instance, Postgres database and document bucket, in a US region, with AWS GovCloud (US) or Azure Government available. Only the load balancer is reachable from the internet, on port 443. Daily encrypted backups are kept 35 days with a copy in a second region under a separate key. The same build can run in a customer’s own cloud account.

Item	Target
Recovery point	24 hours from daily backups; minutes with point-in-time recovery
Recovery time	8 hours
Uptime	99.9% monthly, excluding maintenance announced 5 business days ahead

Encryption

• In transit: TLS 1.2 or later, HSTS, and every connector refuses non-HTTPS endpoints.
• At rest: every record, ledger event and stored file is encrypted with AES-256-GCM before it is written, under the tenant’s own 256-bit data key.
• Keys: data keys are wrapped by AWS KMS (bound to the tenant through the encryption context, every unwrap logged in CloudTrail), optionally the customer’s own key, which they can disable to cut off access to all of their data. Small installs can use an operator-held master key.
• Binding: each ciphertext is bound to its tenant, collection and record id, so a row copied over another, or edited, fails to decrypt.
• Originals: stored documents are sealed the same way and carry a SHA-256 hash checked on read.
• Sessions: stored as hashes of their tokens.
• Secrets: from the cloud secret manager through the environment; never written to the database or logs.

Identity and access

OpenID Connect with PKCE or SAML 2.0, with an optional multi-factor requirement; SCIM 2.0 provisioning; no self-provisioning; role permissions on every action; segregation of duties per transaction against the ledger; approval limits and no self-approval, including for delegates. Supplier users only see their own records.

Audit trail

A per-tenant, hash-chained ledger records every action by a person, agent, supplier or integration, with the actor, the duty performed and, for AI output, the model, prompt version and input digest. Each hour every ledger head is signed and sent to the SIEM feed, so a ledger cut short or rewritten and re-hashed is detected. See Security feed and audit.

AI and data

• AI features call Anthropic’s Claude models through the Anthropic API under commercial terms that do not train on customer data. We do not use customer data to train models.
• The policy pack can name document classes never sent to the AI provider, such as BES Cyber System Information. Those go to a person, and a document.ai_skipped event is recorded.
• For each AI call the ledger keeps the model, prompt version and a digest of the input, not a copy.
• Agents can never approve, award, release payments or change policy.

Data ownership and exit

Administrators can export everything at any time as NDJSON with counts, a ledger verification and a checksum. After contract end, data is kept 30 days for a final export, then the tenant’s data key is destroyed, making every backup copy unreadable, and the destruction is certified in writing.

Vulnerability management

Few dependencies (no web framework, no cloud SDKs), pinned in the lockfile, with a dependency audit that fails the build on any high or critical advisory. Third-party penetration test before go-live and yearly; critical findings fixed within 7 days and high within 30. SOC 2 Type II audit planned.

Incident response

We notify the customer within 24 hours of a suspected or actual breach, counted from detection: detect and triage, contain within 4 hours, notify within 24 hours with daily updates, recover and verify the ledger, and a written root-cause report within 10 business days.