Security model

Assume a breach. Limit its reach.

HypaBrand holds authorisations that can spend money and speak as a brand, so nothing reaches everything.

A description of the controls designed and being built in Phase 0, not a certification.

Four invariants

Two applications, one secret boundary.

The web application never holds a key-encryption key, a sealing key or a provider secret.

  • Forced row-level security

    Every tenant row carries its workspace; policies fail closed without a context.

  • Worker holds the keys

    The web tier never holds a key and can never decrypt a token.

  • Raw first, with provenance

    Every provider payload is kept before normalisation, so figures recompute from source.

  • People approve every action

    Agents propose; a deterministic executor acts with policy checks and rollback data.

Architecture: browser, web, worker, vault, Postgres and providers Web app · no secrets Worker · no inbound connection Browser Web Hono · sessions · CSP Worker jobs · connectors · gateway Postgres · RLS forced Tenant context, per transaction Vault Key-encryption key Providers OAuth code, sealed to the worker Official APIs, least privilege
Two applications, one secret boundary. The orange path is the sealed hand-off.

Architecture invariants

Twelve rules that need an architecture decision to change.

  1. Every tenant row carries its workspace; row-level security is forced and fails closed.
  2. Provider tokens are envelope-encrypted; the key-encryption key exists only in the worker.
  3. Every analytics payload is preserved raw, with provenance, before normalisation.
  4. Metrics are bitemporal; configuration history is kept, never overwritten silently.
  5. Eight record kinds; a hypothesis never becomes a fact by repetition or confidence.
  6. Agents never call provider write APIs; a deterministic executor performs approved actions.
  7. Untrusted content is data, never instructions; contexts holding it get no side-effect tools.
  8. Every model call goes through one gateway and records model, cost, tenant and trace.
  9. Interfaces use design tokens only and meet WCAG 2.2 AA with full keyboard operation.
  10. Commodity is integrated, intelligence is built; the stack grows only with a trigger.
  11. Measurement lenses are never merged; every revenue number states its lens.
  12. No new infrastructure, vendor or runtime without a trigger or an architecture decision.

Trust boundaries

Six boundaries, each with its controls.

  • Users → web MFA with passkeys; short-lived sessions verified per request; strict CSP; rate limits.
  • Web → database Forced row-level security; tenant context only inside a transaction; no bypass roles.
  • Web → worker OAuth codes travel sealed to the worker’s key; jobs carry ids, never tokens.
  • Worker → providers Least-privilege scopes, per-account rate budgets, no token logging.
  • Apps → model providers One gateway; no secrets or raw personal data; training disabled.
  • CI → production App-scoped deploy tokens; worker deploys behind a protected environment.

Threat model

What the threat model assumes.

  • Any component compromised

    One breach must not reach every brand, token or action.

  • Untrusted content everywhere

    Comments, pages and uploads never reach a context that can act.

  • Reviewed before each phase

    Every new trust boundary re-opens the threat model before it ships.

Standards baseline

  • OWASP ASVS 5.0: Level 2 for the product, Level 3 for the vault and executor.
  • OWASP Top 10:2025 and the LLM Top 10 mapped to tests.
  • WCAG 2.2 AA on every screen.

Ready when your brand is.

The portal opens without a sign-in while the pilot runs.

Open portal