Security and control architecture
Financial evidence deserves a fail-closed system.
ChainClose is designed around tenant isolation, read-only source permissions, immutable evidence, fixed-precision calculations and audited privileged actions.
Architecture implemented · deployment evidence pending
- Isolate
- Service authorization plus PostgreSQL RLS.
- Preserve
- Append-only evidence and immutable releases.
- Limit
- Read-only sources and separate partner authority.
Identity, tenancy and privileged access
- Organisation-scoped membership and explicit permissions.
- Server-side authorization; hidden controls are never the boundary.
- AAL2 gates on sensitive commands and audited actor/reason evidence.
- Separate API, web, worker and migration identities in deployment design.
Data and secret handling
- No exchange trade or withdrawal scopes in the finance ingestion product.
- Secret references and exact versions stay separate from business records.
- Raw evidence is content-addressed; corrections append.
- Portable client exports exclude credentials and provider lease tokens.
Secure delivery
- Formatting, lint, static types, unit/API, golden, tenant-isolation, database and browser gates.
- Non-root digest-oriented API, web and worker containers.
- Strict browser failure oracle and multi-engine responsive traversal.
- Incident, deployment, backup and restore runbooks.
Evidence still required before production
Local tests and image builds do not prove deployed IAM, CMEK, network policy, Object Lock, OIDC, telemetry, vulnerability/signature enforcement, restore performance or penetration resistance. Those controls remain named release gates.