How Revvyn protects payment data and enforces governance.
| Layer | Method | Status |
|---|---|---|
| In transit | TLS 1.3 / HTTPS, terminated at the Render edge | ✓ |
| At rest | PostgreSQL TDE (Render managed encryption) | ✓ |
| API keys | SHA-256 hashed, raw never stored | ✓ |
| Webhooks | HMAC-SHA256 signed payloads | ✓ |
| Control | Implementation |
|---|---|
| API authentication | SHA-256 hashed API keys via X-API-Key header |
| Multi-tenancy | Tenant-scoped queries + PostgreSQL Row-Level Security |
| RBAC | 4 roles: admin, operator, auditor, readonly |
| SSO | SAML/OIDC not yet implemented — placeholder metadata only |
| Rate limiting | Per-tenant via slowapi with X-RateLimit headers |
| IP allowlisting | CIDR allowlist stored per tenant; request-time enforcement not yet wired |
| Control | SOC2 Mapping |
|---|---|
| Append-only, hash-chained audit trail | CC7.2, CC7.3 — PostgreSQL trigger prevents UPDATE/DELETE (not yet externally anchored) |
| Retention | P4.2 — a 7-year retention target is stamped on each record at write; records are append-only, automated deletion after 7 years is not yet implemented |
| Auth event logging | CC7.2 — every key validation logged |
| Request tracing | CC7.2 — X-Request-ID on every response |
| Admin action audit | CC6.1 — policy changes, key rotations logged |
| Compliance reports | CC7.4 — JSON/CSV export for auditors |
Data sovereignty: Managed PostgreSQL 18 in Frankfurt, EU, on Render (the web service also runs in the EU).
GDPR: A Data Processing Agreement is available. Audit records are stamped with a 7-year retention target; the lawful basis for retention and the right-to-erasure position are being confirmed with counsel.
Backup: Automated backups and point-in-time recovery are provided by the Render PostgreSQL plan (verify the plan, backup cadence and PITR window in the Render dashboard); specific RTO/RPO figures are not independently verified here.
| Practice | Implementation |
|---|---|
| Input validation | Pydantic models on all API inputs |
| SQL injection | SQLAlchemy ORM (parameterized queries) |
| XSS | HTML surfaces (docs, console shells) protected by a strict Content-Security-Policy; API responses are JSON |
| CSRF | State-changing console routes use a SameSite=Lax session cookie with a same-site Origin allowlist; API-key/server callers use a custom header and are CSRF-immune |
| Dependency scanning | safety + Trivy in CI |
| SAST | bandit in CI — the gate blocks any medium/high-severity finding |
| Secret scanning | gitleaks in CI |
Platform: Render (managed hosting, EU region). Revvyn's own SOC 2 controls are being implemented — not yet certified.
Docker: Multi-stage build, non-root user, no debug tools in production.
CI/CD: GitHub Actions — lint, security scan, test, Docker build + Trivy vulnerability scan.