Consumer Messaging Platform — WhatsApp-Class System · View 20 of 23

Security Trust Zones

Five zones in decreasing exposure, the attacks that arrive at each, and what stops them — with the flow crossing every boundary labelled.

Editable source SVG draw.io All views

What an attacker gets

Perimeter breach: rate-limited access to an authenticated session surface
Data zone breach: ciphertext and metadata, no message content
Full platform compromise still requires a device private key to read a message

Controls at each boundary

Anycast scrubbing absorbs volumetric traffic before it reaches a terminator
Noise handshake pins the device key, so a stolen bearer token is not enough
Service-to-service calls carry device-scoped claims with a 15-minute lifetime

Key and audit zone

The backup key vault permits ten attempts and then locks the record permanently
Every vault access writes an append-only audit record
KMS is HSM-backed and issues envelope keys only; it never sees a message key