Platform Security Principles and Overview
An overview of the platform's security design principles, including in-VPC data residency, role-based access control (RBAC), and encrypted credentials.
Overview
The platform is designed with security as a core constraint. It operates entirely within an API publisher's own infrastructure, does not expose public endpoints by default, keeps all customer traffic and data within the publisher's network, and provides a complete audit trail for all configuration changes.
This document provides an overview of the key security principles and features of the platform.
Security Principles
The platform's security model is based on the following principles:
1. Runs in Your Infrastructure
All platform components—including the control plane, runtime, workers, and database—run inside your own network infrastructure. All API traffic, request/response payloads, data archives, and the metadata database remain within your VPC.
The only outbound communication is a minimal, metadata-only signal to the Specaria platform for licensing and software update notifications. This signal never contains customer payloads, hostnames, or API consumer identifiers.
2. No Public Endpoint
By default, both the runtime and administrative services are configured with internal-only ingress. There is no public-facing URL. Access to these services is mediated through your network's internal load balancer and an identity-aware proxy.
3. Role-Based Access Control (RBAC)
Every endpoint in the control plane enforces role-based access control. The platform defines three distinct roles:
- admin
- operator
- reader
Role assignments can be resolved from your existing Identity Provider (IdP) groups, from direct in-app principal bindings, or from an emergency bootstrap list. This multi-faceted approach ensures you are never locked out of the system or solely dependent on a single external system for granting access.
4. Identity-Aware Access
Access for operators is managed through an identity-aware proxy, which injects an authenticated user identity into requests. Supported identity providers include Google IAP, Azure AD, and standard SAML / OIDC.
5. Encrypted Backend Credentials
Credentials for connecting to backend services (such as Basic Auth, Bearer Token, API keys, OAuth2 client credentials, and mTLS materials) are stored encrypted at rest using pgcrypto.
Plaintext credential values are never written to logs and are never returned in API responses. The API only exposes metadata about credentials, such as whether a credential is set and when it was last updated.
6. Complete Audit Trail
Every change to the platform's configuration is recorded as an audit event. Each event includes the actor and their role, the action performed, the state before and after the change, and a correlation ID. This audit trail is retained for 60 days by default and is queryable from the UI.
7. Outbound-Only, PII-Redacted Telemetry
The platform communicates outbound over HTTPS only to the Specaria platform. It sends only numeric counts, software versions, a hashed host fingerprint, an installation ID, a customer label, and a contact email. It never sends API payloads, hostnames, API consumer identifiers, or any other Personally Identifiable Information (PII).
NOTE
Licensing Telemetry The integration with the central Specaria platform for features like JWKS-verified licensing, heartbeat telemetry, and update notifications sends metadata only. It does not transmit payloads or PII. The security properties described above (no public endpoint, in-VPC data, RBAC, encrypted credentials, audit trail) are independent of this integration.
Security Features Summary
The following table summarizes how the platform addresses key security concerns.
| Concern | How the platform addresses it | Detail |
|---|---|---|
| Data residency | Everything runs in your VPC; payloads never leave | Network |
| Network exposure | No public endpoint; internal-only ingress by default | Network |
| Access control | RBAC mapped from your IdP / in-app bindings / bootstrap | RBAC |
| Authentication | Identity-aware proxy; IAP / Azure AD / SAML / OIDC | Authentication |
| Secrets | Backend credentials encrypted at rest, never logged | Credentials |
| Database auth | IAM database authentication on Google Cloud | Network |
| Accountability | Full audit trail with actor, action, before/after | Audit |
| Retention | 60-day default, configurable | Data retention |
| Vendor data exposure | Outbound-only, numeric/metadata telemetry; no PII, no payloads | Egress allow-list |
See Also
For more detailed information on specific security topics, refer to the following documentation:
- Network & Data Residency
- Role-Based Access Control (RBAC) & Roles
- Authentication
- Backend Credential Encryption
- Audit Trail
- Data Retention
- Licensing
- Licensing Egress Allow-list