Security Model

Defense in Depth

Four security layers protecting every document from creation through delivery.

Network Layer

Zero Exposed Ports

All services run on internal ports only. No direct internet exposure. External access is exclusively through Cloudflare Zero Trust tunnels.

Cloudflare Zero Trust

Every request passes through Cloudflare's edge network with identity verification, device posture checks, and geo-restrictions before reaching the tunnel.

Rate Limiting

Configurable per-endpoint rate limits with sliding window counters. Automatic blocking with exponential backoff for repeat offenders.

Webhook Validation

HMAC-SHA256 signature verification on all inbound webhooks with timestamp validation and replay attack prevention.

Application Layer

Control Implementation
AuthenticationOTP-based verification for all signing and viewing sessions
AuthorizationThree-tier governance model (Tier 0 auto, Tier 1 OTP, Tier 2 manual)
Session IsolationUnique session IDs with time-limited access tokens
Viewer ProtectionCopy, print, download, screenshot prevention in SDC viewer
Export PolicyFour-tier export control (none, watermarked, redacted, full)
Forensic WatermarkInvisible per-session watermarks for leak traceability

Cryptographic Layer

Function Algorithm Purpose
EncryptionAES-256-GCMAt-rest document and backup encryption
HashingSHA-256Document fingerprinting and chain integrity
Key DerivationPBKDF2 (100k iterations)Encryption key generation from passwords
SignaturesHMAC-SHA256Webhook validation and document signing
CanonicalizationDeterministic normalizationReproducible hashing across formats

Operational Layer

Encrypted Backups

AES-256-GCM encrypted archives with 7-day rotation, chain verification, and point-in-time recovery capability.

Immutable Ledgers

Seven independent hash-chain ledgers tracking governance, access, signing, conversation, perimeter, backup, and lifecycle events.

Health Monitoring

Real-time system health dashboard on port 3005. Service readiness checks, IPFS connectivity, and backup status monitoring.

Perimeter Logging

Every network event logged to the perimeter ledger: access grants, denials, rate limits, validation failures, and replay attempts.

Security Controls Summary

Control Layer Status
Zero Trust tunnelsNetworkActive
Rate limitingNetworkActive
HMAC webhook validationNetworkActive
Replay preventionNetworkActive
OTP verificationApplicationActive
Tiered governanceApplicationActive
Viewer protectionApplicationActive
AES-256-GCM encryptionCryptographicActive
SHA-256 fingerprintingCryptographicActive
Hash-chain ledgersCryptographicActive
Encrypted backupsOperationalActive
Health monitoringOperationalActive
Deterministic processingCryptographicActive

Compliance

Standard Coverage
ESIGN Act (2000)Digital signature ceremonies with full consent capture
UETAElectronic records with attribution and integrity
SEC Rule 17a-4Immutable storage via IPFS with hash-chain verification
SOC 2 (alignment)Access controls, audit trails, encryption at rest
TCPAOpt-in consent, STOP/HELP handling in telecom layer