Incident Management Platform  ·  View 32 of 34  ·  7 · Assurance

Security — Trust Zones and What Crosses Them

Five zones from untrusted senders to key custody, and the one credential or token that each crossing requires.

Editable source SVG draw.io All views
Untrusted senders Integrations one credential each Responder devices app · SMS · voice Edge Ingest gateway verify before parse Ack receiver signed, single-use Paging cells Incident engine mTLS between cells Dispatcher decrypts at send Key custody OpenBao secrets · transit Responder keys deleted on offboarding Control plane Console team-scoped RBAC Event log row-level security HMAC · TLS ack token normalised unwrap data key short-lived creds Security — Trust Zones and What Crosses Them External / third party Security / platform Application we own Data store synchronous event / async An integration's credential can only submit alerts for itself. A leaked ack token stops one escalation once; it cannot read an incident. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Every integration is untrusted and has its own credential. Two secrets are valid per integration during rotation, both held in OpenBao, and revoking one integration never touches another or needs a deploy (ADR-27).
  • Acknowledgement tokens are signed, bound to one incident, one responder and one step, and single-use. A forwarded SMS can stop one escalation once; it cannot read the incident or acknowledge anything else.
  • Contact addresses are decrypted by the dispatcher at send time only, using a per-responder key unwrapped through OpenBao's transit engine. The event log and the console never hold them in clear.

Controls

  • mTLS between cells and between cells and the control plane, from a platform-only PKI in OpenBao. Encryption at rest on every host and bucket. Sensitive incidents restricted by PostgreSQL row-level security to a named group, with the restriction itself an audited event (ADR-29).

Risks

  • The responder app is the most exposed client. It holds no long-lived secret beyond a device key, receives only ack tokens and summaries in push payloads, and a lost device is revoked by removing its key.
◀  The Loop the Platform Exists to Close All views Identity — Signing In When the Identity Provider Is the Outage  ▶
Solution Architecture v1.0 · Reliability Architecture · 2026-09 · 34 views · open source, fully on-premises32-security-trust-zones