Trust & Architecture

Designed for enterprise security review.

This page is the canonical answer for procurement teams, information-security reviewers, and technical due-diligence: how Tricognita protects your data, isolates your tenant, and stays operable during incidents.

Foundational guarantees

Four pillars that hold under scrutiny.

Tenant isolation by architecture

Every request carries a tenant id in the JIT token claim, mintable only from a verified session — never from request body or headers. The browser cache is flushed at every auth-boundary crossing. Notifications are keyed per-tenant. Cross-tenant data exposure requires defeating four independent layers.

Read-only by default

Every cloud action begins as a read-only operation. Destructive remediations require OPERATOR-tier JIT tokens AND typed-phrase confirmation in the UI. AUTONOMOUS healing is opt-in per tenant. No write happens silently.

Hash-linked audit chain

Every operator decision and ARIA action is written to a hash-linked audit_logs table. Tampering with a row breaks every downstream hash. The trail is the SOC 2 / ISO 27001 evidence pack — produced continuously, not assembled annually.

Sovereign data residency

Scan results live in your AWS account. ARIA telemetry is processed in your selected region. The control plane authenticates and orchestrates — it does not warehouse your customer data.

Operational guarantees

Verifiable from CloudTrail and the Tricognita audit chain.

These aren't promises in a marketing deck — they're enforced by the code that runs in your account. Every guarantee here is verifiable from CloudTrail or the Tricognita audit chain.

Session TTL

15 min access + 7-day refresh

Refresh rotation

Atomic delete-then-issue with replay detection

JIT tokens

HMAC-SHA256, tier-mapped from session role

Healing default

OPERATOR approval required

Data residency

Customer AWS account

Audit retention

Indefinite (hash-linked)

TLS / HSTS

HSTS preload, 2-year, includeSubDomains

CSP

frame-ancestors none, object-src none, no eval

Traceability

When something breaks, you can prove what happened.

Correlation id end-to-end

Every request carries a 12-character id minted client-side, propagated through the BFF, into the Go API logs, and back in the response header. A customer-reported incident becomes a one-paste trace across browser → BFF → Go → audit.

Release pinning

Every deploy exposes its version, git SHA, branch, and environment via /api/version. The dashboard surfaces the same in the operations console. An incident ticket pins to an exact deploy with one click.

Structured BFF logs

All BFF routes emit single-line JSON: ts, level, request_id, elapsed_ms, route-specific fields. Vercel + Fly logs aggregate the same correlation id so cross-tier debugging is trivial.

Per-tenant Redis scoping

Notifications, quotas, and refresh tokens live in tenant-scoped Redis keys. A platform-tenant ADMIN sees cross-tenant aggregates; everyone else sees only their tenant's keys. Key boundary > in-memory filter.

Architecture

The control plane.


  Browser  ──HTTPS──▶  Cloudflare  ──▶  Vercel Edge / BFF (Next.js)
                                              │
                                       ┌──────┼──────┐
                                       ▼      ▼      ▼
                                Session  JIT mint  Audit emit
                                       │      │      │
                                       └──────┼──────┘
                                              ▼
                                     Go API (Fly.io, sin region)
                                       │      │      │
                                       ▼      ▼      ▼
                                  Postgres   Bedrock   AWS STS
                                  (Neon)     SageMaker AssumeRole
                                                       │
                                                       ▼
                                            Customer AWS account
                                            (read-only IAM role)

Customer cloud data never traverses our control plane. ARIA performs assume-role into the customer's account and returns posture artifacts, not raw resources. Cross-tenant data sharing requires defeating four enforcement layers (edge middleware → BFF session → Go JIT tier → AWS STS).

Reviewer references

Deeper documents on request.

We maintain reviewer-facing documentation that walks through tenant isolation per-route, the on-call playbook, scalability assumptions, and the cache lifecycle. These are shared with design partners under NDA on request.

Security architecture summary

Auth, RBAC, tenant isolation, audit, observability.

Tenant isolation audit

Every BFF route classified by enforcement mechanism.

Production readiness

Deployment topology, scaling assumptions, runbook.

Scalability audit

Capacity ceilings, bottlenecks, verification methodology.

Bring this to your security team.

We'll walk your reviewers through the architecture, share the full documentation suite under NDA, and answer questions from your internal infosec process.

Schedule a technical review