Deliverable 8
Security architecture
Security is designed in from the start. Customer credentials and confidential data are never exposed to the control plane or the browser.
Authentication
- Email + SSO (Google / Microsoft / SAML for enterprise).
- Mandatory MFA for all SN staff.
- Short-lived sessions, refresh rotation.
Role-based permissions
- Roles in a dedicated user_roles table, checked server-side.
- Platform: owner, admin, finance, support, engineer, auditor.
- Customer roles defined per product and per tenant.
Customer data isolation
- Shared cloud: tenant_id + Row-Level Security on every table.
- Dedicated: physically separate database and storage.
- Control plane has no credentials to customer databases.
Audit logging
- Append-only audit_logs for every privileged action.
- Who, what, when, from where, and before/after values.
- Exportable for customer compliance reviews.
Secure APIs & secrets
- TLS everywhere; signed, scoped service tokens.
- Secrets held in a managed vault, never in code or the browser.
- Key rotation on schedule and on staff off-boarding.
Backup & disaster recovery
- Daily backups + point-in-time recovery.
- Encrypted, separate-region copies.
- Quarterly restore drills; documented RPO/RTO per plan.
Controlled support access
- Customer-approved, time-boxed access grants.
- Read-only by default; elevation requires a second approver.
- Every session recorded in the audit log.
Deployment security
- CI/CD with dependency and secret scanning.
- Staging before production; approved releases only.
- No public deployment without owner approval.