Security
Layered, and provable.
A request is authenticated at the edge, scoped to exactly one organisation, and that scope is re-asserted at every store it touches. Below is what each layer defends — and what is not there yet.
Defence in depth
Nine layers on the platform.
| Layer | Control |
|---|---|
| 1 — Edge | TLS 1.2/1.3, HTTP redirected to HTTPS, per-IP rate limiting, unknown hosts dropped |
| 2 — Gateway | Key authentication, per-key quotas, header sanitisation, request signing |
| 3 — Identity | One verification chokepoint for tokens, keys and signed internal calls |
| 4 — Authorization | Tenant isolation, roles, resource grants, key scopes |
| 5 — Routing | Ownership guard, read-only gating, circuit breaking |
| 6 — Stores | Mandatory tenant filters on every query; TLS to managed databases |
| 7 — Perimeter | Secret and personal-data detection, classification, value-level masking |
| 8 — Secrets | Envelope encryption with a separately-held master key |
| 9 — Audit | Immutable, tenant-scoped record of every privileged action |
Threat model
What each layer actually stops.
Passive eavesdropping
Encrypted UDP only. Nothing readable on the wire.
An attacker on the tunnel subnet
Rejected. Talking to a box requires a certificate signed by our internal authority.
Chordian is breached
No customer memory, no SSH keys, no box encryption keys. None of them are on our side.
Your box disk is stolen
Useless without the box key — which Chordian does not hold and cannot produce.
A tampered image
Signed in CI and verified before install. Rejected before it runs.
A legal request served on us
No stored content to produce.
Compliance
Structural, procedural, and missing.
Some objectives are satisfied by how a system is shaped. Others need an organisational programme on top. Here is which is which.
Structural on own-infrastructure
Data residency — the data is in your region because the machine is.
Data minimisation — the vendor retains no content.
Processor scope — narrowly bounded, which simplifies the data-processing agreement.
Strong across all tiers
Encryption in transit and at rest, with keys held separately from the data.
Tenant isolation enforced on every query and verified in CI.
A complete, credential-free audit trail of privileged actions.
Not there yet
No SOC 2 Type 2 attestation. The control mapping exists and the controls are real; the audit is an organisational programme that has not completed.
No selective right-to-erasure. Whole-organisation purge exists; per-record deletion does not.
No built-in backup for customer-run boxes. If you run your own infrastructure, plan for this explicitly.
We publish this list because a security reviewer will find these anyway, and because a vendor that volunteers its gaps is easier to believe about everything else. Ask us for the current subprocessor list — it is maintained as a controlled document rather than a web page, so it cannot drift out of date.
Send us your security questionnaire.
We would rather answer it directly than have you infer the answers. Most of it is already written down.