Security Operations

Customer Security Boundary

The customer owns the host, network, PostgreSQL service, object or file storage, encryption keys, TLS private keys, identity administration, backups, monitoring, retention, and incident response for the on-premise deployment.

Required Controls

Identity and Access

Require MFA for every real administrator before imports, connectors, or evidence access.
Use named accounts, least privilege, role separation, and periodic access review.
Protect account recovery with a verified backup email and monitored SMTP path.
Disable departed users promptly and review service accounts and application identities.

Network and Transport

Publish only HTTPS TCP 443 through the approved reverse proxy.
Use an RSA 4096-bit certificate and TLS 1.2 or newer.
Keep PostgreSQL on a private network and require encrypted database transport.
Restrict connector egress to customer-approved endpoints.
Restrict collector uploads by token, source network, expiration, and intended tenant.

Secrets and Data

Store database passwords, recovery secrets, connector secrets, license files, and TLS keys in an approved secrets system.
Encrypt database, evidence storage, logs, and backups at rest.
Rotate secrets after suspected exposure and according to customer policy.
Do not place secrets or customer evidence in source control, tickets, or unapproved support channels.

Logging and Monitoring

Synchronize time and forward application, authentication, authorization, license, connector, database, reverse-proxy, and host-security logs to the customer SIEM.
Alert on repeated authentication failure, privilege change, connector creation, bulk export, evidence deletion, license failure, backup failure, and unexpected network access.
Protect logs from alteration and retain them according to the customer policy and regulatory requirements.

Patching and Vulnerability Management

Use supported OS, database, runtime, proxy, and container versions.
Review release notes and SBOMs before updates.
Scan host and container images, prioritize exploitable vulnerabilities, and document remediation or accepted residual risk.
Test updates in a nonproduction environment before promotion.

External Processing

Customer evidence is processed locally by default. No customer data is sent to external AI services by default. Any optional external processing requires explicit customer configuration, approved contractual terms, documented data classification, and an approved data-flow boundary.

Incident Response

Document the customer incident owner, Project X IT support contact, severity path, evidence preservation process, key-rotation procedure, containment actions, notification requirements, and recovery approval. Never send raw customer evidence unless the customer authorizes a protected transfer.