TRUST / SECURITY
Least privilege. Encrypted everywhere.
IAM scoped per role. AWS KMS at rest. TLS 1.2+ in transit. VPC endpoints for S3 and Glue. SOC 2 Type II audit underway.
AES-256
At rest (KMS)
TLS 1.2+
In transit
SOC 2 II
Audit in progress
Identity and access
AWS IAM roles are scoped to the minimum action set per service. No long-lived access keys for production. STS short-lived credentials only. Human access via SSO. MFA enforced.
- Per-role policies attached to specific S3 prefixes and Glue databases
- Production read/write split — data engineers cannot read raw bidstream PII
- Secrets in AWS Secrets Manager. Rotation enforced for database credentials.
- CloudTrail logged to immutable S3 bucket. 13-month retention.
Encryption
| Surface | Mechanism | Key custody |
|---|---|---|
| S3 raw + Iceberg | SSE-KMS, customer-managed key | AWS KMS, account-owned |
| RDS metadata | AES-256 at rest, TLS in flight | AWS KMS |
| NebulaGraph storage | EBS gp3 encrypted | AWS KMS |
| Backups | Cross-region replicated, encrypted | AWS KMS |
| Customer file dropoff | SSE-KMS + presigned URLs | Customer or shared key |
Network
- VPC endpoints for S3, Glue, KMS, Secrets Manager — no public traffic for data plane
- Private subnets for compute (EMR, EC2). Bastion-only ingress.
- Security groups default-deny; per-port allowlists reviewed quarterly
- WAF in front of customer-facing dashboards
Application security
- Dependency scanning (Dependabot, pip-audit) on every PR
- SAST in CI; secrets scanning before merge
- Container images built from minimal base; CVE scan before deploy
- Code review required; production deploys require two-person approval
Compliance posture
- SOC 2 Type II — observation period in progress; report available under MNDA on completion
- HIPAA — not a covered entity; we do not accept PHI. NPPES NPI is public-domain provider data.
- Customer DPAs available. Standard Contractual Clauses (SCCs) for EU data importers.
Incident response
24/7 on-call. PagerDuty rotation. Documented runbooks for data exposure, credential leak, and pipeline failure. Customer notification within contractual SLA, never longer than what applicable law requires for a personal-data breach.