Security Architecture (one-pager)

The enterprise security posture of a Cybros install — trust boundaries, secrets handling, identity, and tamper-evident audit.

Trust boundaries

  ┌─ Untrusted ─┐   ┌──────────── Cybros trust boundary ─────────────┐
  │  Browser    │   │  ┌────────┐        ┌────────────────────────┐  │
  │  (session   │──▶│  │  web   │──REST─▶│  api  (all logic +      │  │
  │   only)     │   │  │(no      │◀──────│       all secrets)      │  │
  └─────────────┘   │  │ secrets)│        └───┬───────────┬────────┘  │
                    │  └────────┘            │           │           │
                    │                   Postgres     Redis/worker    │
                    └────────────────────────┼───────────┼──────────┘
                                             │           │  (opt-in egress only)
                                    GitHub · IdP · KMS · Payment · LLM

• web holds no secrets — only a user session; it talks to api over typed REST.
• api is the only trusted plane — all business logic, RBAC decisions, and secrets live here. Postgres/Redis are private and never internet-exposed.
• Egress is opt-in per integration and default-deny at the network layer.

Secrets handling (CMEK)

• Integration secrets (GitHub keys, IdP client secrets, payment keys) are stored envelope-encrypted — AES-256-GCM under SECRET_ENCRYPTION_KEY (32 bytes).
• CMEK: that master key is sourced from your KMS (AWS/GCP/Azure/Vault) via an ExternalSecret; Cybros never persists it in plaintext. Revoking the KMS key revokes Cybros's ability to decrypt. See docs/data-residency.md.
• No secret is ever written to logs, the ConfigMap, or the /system/deployment surface (booleans only).

Identity: RBAC · SSO · SCIM

• RBAC — every mutating API route is gated by a typed permission (require_permission(...)); permissions are org-scoped.
• SSO — SAML/OIDC-agnostic connections; the api validates asymmetric (RS256/ES256) tokens against the IdP's JWKS — no shared JWT secret.
• SCIM 2.0 — provisioning/de-provisioning of users and groups from the IdP (SCIM_ENABLED), so access is centrally governed and revocation is immediate.
• Advertised on /system/deployment as features.sso / features.scim.

Tamper-evident audit

• Security-relevant actions are written to an append-only audit log whose entries form a hash-chain (each row commits to the prior row's hash).
• Any deletion/mutation of history breaks the chain and is detectable on verification — an integrity guarantee for compliance evidence.
• Paired with the append-only credit ledger (balances derived, never mutated), the system's financial and security records are both non-repudiable.

Deployment hardening

• Containers run non-root with allowPrivilegeEscalation: false and all Linux capabilities dropped (chart securityContext).
• DB migrations run as an isolated pre-install Helm hook Job, not from app pods.
• No telemetry / phone-home. On-prem default egress is zero; AI and payment providers are deterministic offline stubs until explicitly configured.
• TLS terminates at the ingress; internal service traffic stays in-cluster / in-VPC.