Real-Time Analytics Platform · View 20 of 21 · Assurance

Security Architecture — Trust Zones

Where the trust boundaries are, what crosses each one and under what authentication, and where an attacker with a stolen credential actually arrives.

Editable source SVG draw.io All views

Zero shared secrets

Every service-to-service hop uses a managed identity over a private endpoint
Producers hold a certificate-bound Entra ID credential, never an Event Hubs SAS key
Key Vault holds customer-managed keys on HSM with 12-month rotation

Blast radius

A stolen producer credential can write forged events for one tenant only — the claim is pinned at the gateway
It cannot read: the write scope carries no query permission
Forged events are recorded and replayable, so the correction path is the replay path

At rest and audit

Customer-managed keys across ADX, ADLS and Redis; bronze is immutable with legal hold
Row-level security on tenant_id is the single enforcement point for read isolation
Query and ingestion audit logs are write-once with 7-year retention

◀ Reliability and Recovery Loop All views Identity and Access Flow ▶