Event-Driven Notification Platform · View 24 of 26 · 6 · Assurance

Security Architecture — Trust Zones

Where the boundaries are, what crosses them, and where an attacker actually arrives.

Editable source SVG draw.io All views

Decisions

Producers never hold a provider credential — the platform holds them per tenant in Vault on one-hour leases
Events carry a subject reference rather than PII, so a compromised producer token leaks routing metadata and not contact data
The tenant boundary is enforced twice: once at the API from the JWT claim, again at the broker by ACL

Attacker paths considered

Forged event: blocked by mTLS workload identity plus a JWT scoped to one tenant
Replayed event: idempotency_key deduplication makes a replay a no-op rather than a duplicate send
Stolen producer token: scoped to one tenant and one event type set, expires in 15 minutes, and cannot read any notification data
Malicious template: no arbitrary code in templates, output sanitised at authoring time

Controls

TLS 1.3 in transit, mesh mTLS between every internal hop, encrypted volumes and per-tenant data keys at rest
Delivery workers reach the internet only through an egress proxy with an allow-list of provider endpoints
Audit is write-once for 7 years under object lock, separate from application storage

◀ The Operator Loop All views Identity and Access — Producer Authentication ▶