Security and trust
What happens when something breaks
A platform that holds keys and money is judged on its failure modes rather than its feature list. These are ours, written down as law.
- Identity fails closed
- No personal data in usage
- Every mutation audited
How it degrades
Written down as law in the repository, so a future change that reverses one of these has to argue with the record first.
Identity fails closed
If Wanda cannot establish who is calling, the call is refused. There is no configuration that reverses this.
Quota fails open, bounded, per plan
If the counter store is unreachable, postpaid traffic continues within a per-plan bound rather than a customer's business stopping. Prepaid and hard-cap plans may declare fail-closed instead.
Bounded, per plan
The fail-open bound is set per plan rather than globally, so a high-value integration and a free tier degrade on their own terms.
How tenants are kept apart
Tenant scope read out of the SQL
A build guard flattens every query in the data layer and demands a tenant predicate bound to a parameter: 77 statements across 14 tenant-scoped tables, with the two genuinely unscoped platform tables in a commented allowlist. Planting an unscoped delete fails the build with file, line and table.
Consumers cannot enumerate each other
A sibling consumer answers as though it does not exist rather than as though it is forbidden, and keys addressed by id resolve ownership from the row rather than from the request.
Personal data never enters usage
The guard refuses an attribute on the key name and again on the value, so an Omang-length digit run is rejected even under an innocuous field name, naming the offending field.
Signed context, short lived
What the gateway delivers upstream is signed and carries a 60 second expiry, so a captured context is not a reusable credential.
Every mutation audited
Actor, before and after, on every change. The audit sweep covers the operator surfaces, including the tax book.
No key material in the repository
Not even a development key. Rehearsal values are committed in clear and are visibly worthless, a key is generated per machine at bootstrap, and a continuous integration guard fails the build if key material is ever committed.
Recovery, measured rather than promised
Backup and restore are drilled on a schedule and the drill is defended by continuous integration, because a restore that has never been run is a hope rather than a control.
Recovery point
Sixty seconds, measured on a real restore rather than quoted from a configuration file.
Recovery time
Under a minute at the scale it was measured, and the scale is published with the figure rather than left off it.
Alerting that watches itself
The drill asserts delivery, not firing, and there is an alert for the alerting path going quiet.
Ask us the hard version.
Bring your own threat model rather than a questionnaire. We would rather answer the specific question your risk team is actually asking.