Security

Every sensitive record has its own data key, wrapped by the master key in the key module. Decrypting one record opens no other.

Privileged decryption only happens in a separate service, with its own cloud profile; the application that serves the API has no such right.

Every privileged decryption enters an append-only trail with a hash chain. An auditor holding the series detects removal.

ECDSA P-256 in the key module; the private key never leaves. The key policy grants the right to sign only to the service that issues receipts, and the right to read the public key to the application. The public key is published as a JWKS.

Live presence comes from an AWS-certified component, declared in the receipt with its version. The opt-out from using data to train AI, the key policy and the permissions were checked in the cloud console and recorded with a date.

Real row-level security in Postgres, with an application role that cannot bypass it. A query without a client returns nothing.

API keys per client and per scope. Dashboard sessions with app-based MFA and recovery codes, seed encrypted at rest, hardened login with attempt limits.

Hummand's operations console has short sessions and MFA delegated to the edge access.

Erasing is the only irreversible operation: it has its own scope, which no integration receives by default. In practice, the dashboard session erases, at the data subject's request.

Today no endpoint distinguishes the role of the caller: any authenticated user of the client invites, removes and erases. Roles by level are planned and replace the current field. Declared, not hidden.

Erasing a record is destroying its data key: the ciphertext becomes unrecoverable. On request, by act or by the client's reference, or by retention period, with a sweep every six hours.

Encrypted verdict and CPF: 90 days. Consent evidence and event trail: five years. Images and biometrics: never retained; it is a product invariant, not configuration.

Automatic TLS, HSTS with subdomains, protection against type sniffing. Credentialed access only for the dashboard, the journey and the console. Every release applies the migration before the new app, with a backup first.

In-memory request limiting, on one instance; no mTLS between services; secrets still in an environment file on the host; no distributed telemetry; backup restore not rehearsed yet; no production threat model nor external pentest.

Distributed limiting and mTLS are contract prerequisites; the rest is the discipline phase of the plan, not started yet.

Found something? Write to [email protected] with the subject "Responsible disclosure". The address is also in /.well-known/security.txt.