数据库转储不会泄露任何信息。

Personal data is encrypted at rest with keys the database never sees, and it stays searchable.

Keys outside the data

Values encrypt and decrypt through HashiCorp Vault Transit. The application never holds key material and the database never sees a key.

A key per tenant

Every tenant gets its own AES-256-GCM key. Encryption is randomized, so identical inputs never produce identical ciphertext.

Searchable without plaintext

Keyed-HMAC blind indexes power login-by-email, search-by-name and domain lookups over data that is never stored in the clear. The index keys are HMACs too, so a dump of the index tables reveals nothing.

Crypto-shredding

Deleting a tenant destroys its key, making all of that tenant's data permanently unrecoverable. That is GDPR Article 17 erasure by cryptography, with no row-by-row deletion.

What is protected

Emails, names, phone numbers, company names and custom attributes are encrypted at rest. Passwords were never stored reversibly. Opaque IDs, roles and timestamps stay clear so the system stays operable.

The keystore is treated as the crown jewels, because it is.

Encrypted in the cluster

Vault's listener runs TLS with a private CA, so Transit traffic is encrypted even on the pod network.

KMS auto-unseal

Vault auto-unseals against an Azure Key Vault key. No unseal keys sit on disk or in a runbook.

HA and backed up

A three-node Raft cluster with a daily snapshot to an isolated, geo-redundant (GRS) account, roughly a 24h RPO. Snapshots are barrier-encrypted.

No root in the cluster

Apps run on scoped, least-privilege per-host tokens. The root token lives in a break-glass vault, not the workload.

Every operation audited

A Vault audit device records every cryptographic operation by token and key. Use of a token outside its policy raises an alert.

Every hop is deny-by-default. A workload can reach only what it is declared to need.

Default-deny both ways

NetworkPolicies deny pod-to-pod ingress and egress by default. A compromised pod cannot move laterally, reach cloud metadata, or exfiltrate freely.

Edge and origin lock

The public surface sits behind Cloudflare for DDoS and WAF, and the origin only accepts traffic from the edge. Direct-to-origin is blocked.

Private data plane

Storage, Key Vault and the container registry are reached over private endpoints, and the Kubernetes API is private.

Admin off the internet

The platform control plane is reachable only over the private network, never the public internet.

The standards you already require, plus phishing-resistant options for the accounts that matter.

OAuth2 / OIDC, done right

Authorization Code with PKCE (RFC 7636) and Pushed Authorization Requests (RFC 9126), so authorization parameters never ride the browser. Tokens are JWTs verified against rotating JWKS.

Enterprise federation

SAML 2.0 sign-in and SCIM 2.0 provisioning (RFC 7643/7644), including group-to-role mapping at token issuance.

MFA and passkeys

TOTP, WebAuthn / FIDO2 passkeys and fully passwordless sign-in, with refresh-token rotation on every use.

Hardened admin

Platform admin is SSO-only through Entra SAML under enforced MFA. There is no admin password to phish.

Controls you can audit, not just claims you can read.

Audit log with alerting

Security-relevant events are logged and alerted on, aligned to SOC 2 CC7 monitoring.

Images scanned in CI

Every container image is scanned for CVEs, and a High or Critical (CVSS) finding blocks the release.

Rotation and patching

Static secrets rotate on a documented cadence and dependency security updates land automatically.

Hardened infrastructure state

Infrastructure state is geo-redundant, versioned, soft-deletable, private, and reachable by identity only, with no shared keys.

报告安全漏洞

发现问题？请发送电子邮件至 [email protected]。我们的机器可读联系信息发布在 /.well-known/security.txt。