Flipkart Marketplace Platform  ·  View 23 of 25  ·  7 · Assurance

Security Zones

Where the trust boundaries are, what crosses them, and where an attacker actually arrives.

Editable source SVG draw.io All views
Untrusted · internet Shopper and seller Bots and account takeover scraping · stuffing Perimeter · Azure edge Front Door WAF OWASP + custom DDoS Protection network tier Bot defence device + behaviour Quota and throttle per token, per IP Application · private VNet, no public IP Envoy Gateway OIDC verify Keycloak MFA on risk Domain services Istio mTLS Authorisation OPA policy Cardholder data environment · separate subscription Payment orchestrator PCI DSS scope Token vault no PAN leaves Managed HSM keys never exported Data · restricted, private endpoints only Citus and Cosmos DB CMK at rest PII tokenisation phone, address Audit log WORM · 8 y HTTPS 443 challenged TLS mTLS + JWT tokens least priv audit Security Architecture — Trust Zones and What Crosses Them Person or role Risk / gap Security / platform Interface / broker Application we own Data store synchronous failure / alternate event / async No service holds a card number and no service reaches the internet directly; egress is through a firewall with an allow-list. Seller documents and customer PII are tokenised before they leave the owning service. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • No workload has a public IP; ingress is Front Door to Private Link only, and egress is through a firewall with an allow-list
  • The cardholder data environment is a separate subscription and cluster — no other workload inherits PCI scope
  • Customer PII is tokenised before it leaves the owning service, so a downstream breach yields tokens

The attacker path

  • Bot farms and credential stuffing arrive at the same door as customers; they are handled at the edge, not by the application
  • Price scraping is a business threat, not just a load one — it is drawn because it changes the WAF ruleset and the rate-limit design
  • The residual risk is a compromised seller account with legitimate credentials, which is a trust-and-safety problem, not a network one

Controls

  • mTLS between every service via the mesh, JWT verified at the gateway and re-checked at the service
  • Customer-managed keys in Key Vault and a Managed HSM for payment keys, which never leave the module
  • Write-once audit log retained 8 years, covering every access to personal and financial data
◀  Peak Load and Graceful Degradation All views Identity and Access Flow  ▶
Solution Architecture v1.0 · Open source on Microsoft Azure · Enterprise Architecture · 2026-0923-security-zones