◆1ACTIVE
Where it lives
Amazon S3 + Aurora PostgreSQL, in our own AWS account
Documents and extracted data are KMS-encrypted at rest with customer-managed keys. Nothing is stored on a third party's platform.
vview is a private operational data platform, in prototype / validation phase. The platform is operated by The Company. This page documents the security controls deployed on vview's infrastructure as of the date below. Every control listed is independently verifiable; the supporting infrastructure-as-code is in a private repository and is reviewable on request via the security contact below.
This is a dated snapshot verified by audit on the date above — not a live-monitoring dashboard. Each control is one of three states: ● ACTIVE — verified active at the last audit; ◐ PENDING — declared or partly built but not yet enforced, flagged plainly; ◇ INFO — context, not a control.
Amazon S3 + Aurora PostgreSQL, in our own AWS account
Documents and extracted data are KMS-encrypted at rest with customer-managed keys. Nothing is stored on a third party's platform.
Amazon Bedrock, invoked in-account
Every model call runs on Bedrock inside the same AWS account as the data — the bedrock is our bedrock. No document or extracted value is ever sent to a consumer AI product, a chatbot, or any endpoint outside the AWS boundary for inference.
No prompt or output trains any model
Under the AWS Service Terms (§50 — Amazon Bedrock), inputs and outputs are not used to train the underlying models and are not shared with model providers. This is contractual, not a setting we could flip.
Per-call cost, tier, model & purpose recorded
Nine thousand-plus rows to date. A call that spends money and writes no ledger row is treated as a defect, not an accident.
Cloudflare terminates TLS as a reverse proxy
Traffic to the app passes through Cloudflare, which decrypts TLS at its edge to apply the firewall and bot controls, then re-encrypts to our origin. No document content is stored at the edge — it is a pass-through. We state this before a reviewer finds it.
Validated on vview.app
Chain validates externally via Verisign Labs.
Wildcard *.vview.app, encrypted edge-to-origin
Cloudflare-issued certificate.
max-age=31536000; includeSubDomains; preload
One-year max-age, includeSubDomains, submitted to the browser preload list.
Issuance restricted to Let's Encrypt, Google Trust Services, SSL.com, DigiCert & Sectigo
CAA limits which CAs may issue for the domain (incl. wildcards).
Cloudflare WAF + OWASP Core Rule Set
Conservative tier; tuned to favour low false-positive rate.
1000 req/min/IP default; 10 req/min/IP on /api/*
Enforced at the Cloudflare edge (per source IP).
Cloudflare Super Bot Fight Mode
Conservative tier; verified bots permitted.
SPF v=spf1 -all; DMARC p=reject
Outbound: SPF -all and DMARC p=reject prevent our domain being forged. Inbound (added 2026-07-13): DMARC alignment is now enforced on every received message before the sender is trusted — a forged From is rejected and recorded, never registered.
AWS KMS customer-managed keys, AES-256
Annual key rotation enabled on every CMK.
All traffic HTTPS — Cloudflare-edge Always Use HTTPS across the zone
S3 bucket-policy TLS-deny is on the config/log bucket; rollout to all buckets is pending.
4 customer-managed CMKs
Separate keys for data, logs, RDS & secrets. A fifth for the us-west-2 replica follows when replication is enabled.
Multi-region trail; log-file validation on
All AWS API calls recorded with cryptographic integrity check.
Dedicated KMS key for audit logs
Separate CMK from application data keys to limit blast radius.
Enabled on audit, archive & replica; 365-day retention on the replica
Default 365-day Governance retention is active on the us-west-2 replica; default retention on the audit + archive buckets is not yet enforced.
CloudTrail Insight events enabled
Flags statistically unusual API call patterns.
CloudTrail S3 data-event logging not yet enabled
Management events are captured with integrity validation; object-level data events are pending. (GuardDuty consumes S3 data events separately.)
Enabled with protection plans active
S3, EKS audit logs, EBS malware scan, RDS login, runtime monitoring, Lambda network, DNS, VPC flow, CloudTrail.
AWS Security Hub
Foundational Security Best Practices (FSBP) standard.
Findings aggregated across all enabled AWS regions
Single us-east-1 aggregator (all-regions linking).
AWS IAM Access Analyzer
Scans IAM policies for external-account access (us-east-1, us-west-2).
AWS Config recording all supported resource types
Delivered to a dedicated, encrypted log bucket.
EventBridge → SNS for HIGH/CRITICAL findings
GuardDuty + Security Hub HIGH/CRITICAL findings route to a confirmed operator email subscription.
Faulty apply, 2026-07-13 — detected & restored within the hour
A terraform apply from a stale branch destroyed the inbound-email stack (receipt rule, handler, IAM) and attempted to delete the email store and container registry. The deletions of the stores were refused by bucket-not-empty and registry-not-empty guards; everything else was restored from main within the hour. No customer data was lost — the data those controls protect survived by design. Alert routing to the operator was re-confirmed the same day. We publish this because surviving an incident is the point of these controls, and hiding one would defeat them.
14-char min, 90-day rotation, 24-password history
Account-wide IAM policy.
IAM Identity Center (SSO)
No long-lived access keys for vview operators.
AWS Secrets Manager, KMS-encrypted
Dedicated secrets CMK; no secrets in source code.
GitHub OIDC provider present; not yet wired
The OIDC provider is registered, but no role federates it yet and there are no CI/CD workflows. Deploys today are manual, gated by a descendant-of-main preflight check and PR review before any apply. Stated as pending rather than implying automation that is not yet built.
S3 object versioning on the data, audit, archive & state buckets
Accidental delete or overwrite is recoverable. The static-assets bucket (non-data) has versioning suspended.
Archive replication us-east-1 → us-west-2 not yet active
Replica bucket is provisioned (with Object Lock); the replication rule is Terraform-declared but pending state reconciliation.
All four S3 PAB controls enabled on every vview bucket
Verified on all 10 buckets (2026-07-13); no public read or list is possible.
vview infrastructure defined in Terraform
Changes through reviewed pull requests; state versioned. The data/audit/static buckets are being reconciled back into Terraform state.
DMARC alignment enforced on receipt
A received message whose From fails DMARC is rejected before the allow-list is even consulted; the raw .eml is retained and the rejection is logged with the claimed sender. Domains that publish no DMARC policy are accepted but stamped with the weaker grade rather than trusted silently. Closed 2026-07-13 — the gap was named on this page before it was fixed.
Every received .eml stored & versioned
Inbound mail — including security reports and rejected messages — is written to a versioned S3 store; prior versions are retained on any overwrite, so the record is recoverable. It is not yet under S3 Object Lock (see honest gaps).
Descendant-of-main preflight + PR review
Every apply and deploy is refused unless the working tree descends from main, and all changes land through pull requests. Enacted 2026-07-13 after a stale branch was applied over live infrastructure; see the incident note in section D.
Amazon S3 + Aurora PostgreSQL, in our AWS account (us-east-1)
Uploaded files are stored encrypted in S3; extracted/structured data lives in Aurora. All encrypted at rest with AWS KMS customer-managed keys.
Anthropic Claude via Amazon Bedrock — invoked in-account
LLM analysis runs on Bedrock inside our AWS account. Your data is not sent to a consumer AI product and does not leave the AWS boundary for inference.
Your data is not used to train any model
Amazon Bedrock does not use prompts or outputs submitted to foundation models to train the underlying models.
Cohabited AWS account during prototype
The platform currently runs in an AWS account shared with other internal workloads. Logical separation is in place (per-resource IAM, KMS, naming) but this is not yet a dedicated, isolated account. Account separation is planned — stated here rather than implying isolation that does not yet exist.
AWS Lambda (Node.js 22.x) + Step Functions
Serverless processing pipeline; no long-running servers.
Amazon Aurora PostgreSQL 16.6
Accessed via the RDS Data API; KMS-encrypted.
Amazon Bedrock — a tiered model ladder
Deterministic checks first, then Ministral-3-8B (t1 assist) → Claude Sonnet-5 (t2) → Pixtral Large (t3 vision); Claude Fable for cross-document reasoning; Claude Haiku for narrative phrasing. Every model runs in-account on Bedrock.us.anthropic.claude-sonnet-4-6 (bulk extraction) and us.anthropic.claude-opus-4-8 (deep analysis).
AWS Textract; Amazon S3 (KMS-encrypted)
Textract for document parsing; S3 for object storage.
Cloudflare Pro — WAF, rate limiting, bot management, Access
Cloudflare Access (Zero-Trust) gates the application; the apex landing page is the only public surface.
Terraform
Infrastructure-as-code; changes via reviewed pull requests.
Prototype / validation phase
Not yet a production-certified system.
Live: a message to this address is received, authenticated (spam/virus/DMARC — but never allow-listed, since a reporter is by definition unknown), stored immutably-versioned, and routed to our security team. Also published at /.well-known/security.txt.
Coordinated disclosure welcomed
No bug bounty currently; researcher acknowledgment offered.
None
Platform holds no SOC 2, ISO 27001, HIPAA, or PCI certifications.
The inbound .eml store retains prior versions on overwrite (recoverable) but is not under S3 Object Lock. True write-once immutability needs a new bucket or an AWS Support action — not a same-session change. We say "versioned & recoverable", never "immutable".
A GitHub OIDC provider exists but nothing federates it and there are no pipelines. Deploys run from an operator laptop, gated by a descendant-of-main preflight and PR review. Automated, least-privilege CI/CD is planned; it is not yet built.
A replica bucket exists with Object Lock, but the replication rule is not yet enabled, so the replica is not being populated. Object-level S3 audit logging (data events) is likewise not yet on.
The delete-protection guard is on the container registry; extending it to every stateful store is in progress. The stores that matter most are additionally protected by versioning and not-empty guards, which is what stopped the 2026-07-13 incident from causing loss.
The platform shares an AWS account with the operator's other workloads, separated logically by IAM, KMS and naming — not yet a dedicated isolated account.
Model prompts and outputs are logged to our own audit bucket (KMS-encrypted, in-account) for cost and abuse review. This is our log, inside our boundary — not a third party — but we name it rather than let a reviewer discover it.
Audit date 2026-07-13 · Dated snapshot, not live monitoring · No third-party requests on this page