Home / Security

Security & data handling

TenantUndo touches your most sensitive data — one customer's complete record — during recovery. The architecture is built around a single principle: the control plane sees metadata and signed evidence, never customer records.

Customer data stays in your environment

Analysis and recovery work runs on a customer-side runner inside your own VPC. It connects outbound only over WebSocket; the control plane never opens an inbound connection to your database. The wire protocol carries graph counts, table names, hashes, job status, and signed evidence references — not row values. Production row data does not leave your environment.

No customer database credentials in the control plane

The runner reads DSNs from environment variables or your secret storage. Those credentials are never stored in the control-plane schema. Introspection additionally refuses write-capable connections for read-only jobs, so an analyze or report job cannot run against a role that could mutate data.

Least privilege by job type

• Read-only DSN for analyze, report, extract, diff, and plan — the entire rehearsal path.
• Separate write DSN used only for an approved merge or erase.
• One-time registration token to enroll a runner, and a signed job protocol so the runner only executes jobs issued by the control plane.

Every write is gated twice

No production write happens without both a hash-pinned plan and a second human's approval of that exact hash. The merge or erase runs inside a transaction that verifies non-target tenants' checksums are unchanged; if the blast radius exceeds the approved plan, it rolls back. Auditor accounts can read evidence but cannot create or approve mutations.

Application-layer controls

• Org scoping and role-based access control (admin, operator, auditor) on every API route.
• Append-only audit log of jobs, approvals, and access.
• Request body limits, HSTS, and a content security policy on the control-plane API.
• Stripe webhook signature verification for billing events.

Signed, verifiable evidence

Every drill, restore, and erasure emits a signed evidence artifact — counts, hashes, and containment confirmation — that you can verify offline without trusting TenantUndo's logs. That artifact is what you hand an auditor or attach to a compliance request.