Security model

Blast-radius minimisation, by design.

HypaBrand will hold authorisations that can spend money, speak as a brand, change a store and read customer personal data. One cross-tenant leak, one stolen token vault or one policy violation could end the business. So the design assumes any component can be compromised and makes sure it cannot reach everything.

This page summarises the architecture as designed and being built in Phase 0. It is a description of controls, not a certification or an audit report.

Invariants

Twelve rules that do not change without an architecture decision.

  1. Every tenant-scoped row carries its workspace (and brand where brand-scoped); row-level security is enabled and forced with restrictive policies that fail closed.
  2. Provider tokens are envelope-encrypted behind one vault interface; the key-encryption key exists only in the worker; the web tier can never decrypt a token.
  3. Every provider payload used for analytics is preserved raw with provenance before normalisation, subject only to provider storage caps.
  4. Time is first-class: metrics are bitemporal and configuration history is kept, never overwritten silently.
  5. The Brand Brain has eight record kinds; agents create records only in initial statuses; a hypothesis never becomes a fact by repetition, age or model confidence.
  6. Agents never call provider write APIs; a deterministic executor performs approved actions with policy checks, audit records and rollback data.
  7. Untrusted content — comments, messages, competitor ads, web pages, uploads, transcripts — is data, never instructions; a model context holding it gets no side-effect tools.
  8. All model calls go through one gateway; every call records model, prompt version, cost, tenant and trace; provider data never improves prompts or models for another tenant.
  9. Interfaces use design tokens only and meet WCAG 2.2 AA with full keyboard operation.
  10. Commodity is integrated, intelligence is built; the stack does not grow without a named trigger.
  11. Measurement lenses are never merged; every revenue or conversion number states its lens.
  12. No new infrastructure, vendor or runtime without a named trigger or an architecture decision record.

Trust boundaries

Two applications, one secret boundary.

The web application never holds a key-encryption key, a sealing private key or a provider client secret. Those exist only in the worker, which accepts no inbound connection.

  • Users → web MFA for every user with passkeys offered; short-lived session tokens verified on every request; strict CSP; rate limits by user, workspace and address.
  • Web → database Forced row-level security with restrictive tenant policies; tenant context set only inside a transaction; SQL-created roles with no bypass.
  • Web → worker OAuth codes travel only sealed to the worker’s public key; jobs carry tenant ids and never tokens; single-use, ten-minute binding checks.
  • Worker → providers Least-privilege scopes, per-account rate budgets, no token logging; provider client secrets only in the worker.
  • Apps → model providers One gateway; the policy registry’s model-context rule enforced; no secrets or raw personal data; training disabled; keys with provider-side spend limits.
  • CI → production App-scoped deploy tokens with explicit expiry; worker deploys behind a protected environment with manual approval; SHA-pinned actions.

Credential custody

One random data key per credential, wrapped by a key-encryption key held only in the worker. Additional authenticated data binds a ciphertext to its row, so it cannot be moved. Every unwrap writes an audit row. Versioned keys, staged rotation, an offline escrow copy and a rotation drill are part of the definition of done.

Tenant isolation

Every tenant table carries its workspace, has row-level security enabled and forced, and a restrictive policy that fails closed. Application roles are created in SQL with no bypass and own no tables. Views use security-invoker semantics. CI checks the catalogue and runs a generated two-tenant isolation test for every table.

Audit and retention

Append-only audit rows with a per-workspace hash chain and a daily anchor written once to object storage. Raw provider payloads are kept with provenance and purged by the policy registry’s retention jobs; workspace deletion is a 30-day grace, then purge and crypto-shred.

Standards baseline

  • OWASP ASVS 5.0: Level 2 for the product, Level 3 for the vault, OAuth connections and the action executor.
  • OWASP Top 10:2025 and the OWASP Top 10 for LLM Applications mapped to tests.
  • WCAG 2.2 AA on every screen.

Untrusted content

Comments, messages, competitor ads, web pages, uploaded files and transcripts are data, never instructions. No single model context combines untrusted input, sensitive data and the ability to change state or communicate externally. Any context that contains untrusted content gets no side-effect tools at all.

Compliance posture

HypaBrand is a processor for brands’ customer data and a controller for its own users’ data. Australia’s Notifiable Data Breaches scheme, UK and EU obligations and platform programme terms are tracked in the design; the legal notices on this site are drafts pending counsel.

Questions about the model?

The threat model is reviewed before each phase that adds a trust boundary.

Open portal Platform tour