Enterprise-grade security. By design, not by accident.

Encryption

At-rest encryption via AWS KMS (Customer Managed Keys, auto-rotated yearly). In-transit TLS 1.2+ enforced for all connections.

• ✓RDS: KMS CMK, storage_encrypted = true
• ✓OpenSearch: node-to-node + encryption at rest
• ✓S3: SSE-KMS on every bucket
• ✓TLS 1.2+ (Policy-Min-TLS-1-2-2019-07)

Isolation

Every tenant is isolated at the database level. Row-Level Security policies enforce tenant_id matching on every query.

• ✓Fail-closed: без tenant_id — 0 строк
• ✓Отдельная роль apexid_app (не владелец)
• ✓Cognito JWT → tenant_id mapping

-- Политика RLS из нашей production-схемы
ALTER TABLE reviews ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON reviews
  FOR ALL
  USING (
    tenant_id = current_setting('app.current_tenant_id')::uuid
  );

-- Приложение устанавливает контекст перед запросом:
SET LOCAL app.current_tenant_id = '...uuid...';
SELECT * FROM reviews;  -- вернёт только свой тенант

Network

All compute runs inside a private VPC (10.0.0.0/16). RDS and OpenSearch are inaccessible from the public internet.

• ✓Private subnets for RDS/OpenSearch
• ✓NAT Gateway for outbound only
• ✓AWS WAF: rate limiting 1000 req/5min
• ✓AWS Managed Rules Common Rule Set

Compliance

GDPR and CCPA compliant today. SOC 2 Type II audit planned for 2026. DPA available on request.

• ✓GDPR: data subject rights supported
• ✓CCPA: opt-out mechanisms
• ✓SOC 2 Roadmap — Q3 2026
• ✓DPA on request — see below

Data Residency

All customer data stays in the European Union. Our primary region is AWS eu-central-1 (Frankfurt, Germany).

• ✓GDPR-compliant region
• ✓No cross-region replication by default
• ✓Backup retention: 7 days
• ✓Data deletion within 30 days on request