Platform Security Foundation

Security Overview

QueryTek Tapestry implements defense-in-depth security controls designed for enterprise-grade identity brokering and partner routing. Our security baseline enforces strict tenant isolation, fail-closed operations, and comprehensive observability across all platform boundaries.

Security Scope & Boundaries

In Scope

  • Identity brokering and session lifecycle management
  • Token handling and cryptographic operations
  • Partner routing and integration controls
  • Platform configuration and secrets management
  • Security observability and incident response

Out of Scope

  • Partner domain-specific business logic
  • Partner-owned compliance workflows
  • Partner-side regulatory reporting
  • Partner application security controls

Supported Browsers

Tapestry tests and supports the latest two major stable releases of Google Chrome, Microsoft Edge (Chromium), Mozilla Firefox, and Apple Safari on desktop. Mobile Safari (iOS) and Chrome (Android) are supported for sign-in and launch redirect entry only. Internet Explorer 11 and legacy Microsoft Edge (EdgeHTML) are not supported. Partner applications after redirect follow each partner’s own browser policy. Session cookies are first-party with Secure and SameSite=Lax attributes.

Identity & Access

Control Objective: Enforce least privilege and multi-factor authentication across all administrative access.

  • SSO + MFA for admin access
  • Role-based access control (RBAC)
  • Periodic access reviews
  • Audit logging of privileged operations

Session & Token Security

Control Objective: Protect authentication state and prevent session-based attacks.

  • Short-lived tokens with refresh rotation
  • Secure cookie settings (HttpOnly, Secure, SameSite)
  • CSRF and redirect validation
  • Fail-closed authentication behavior

Multi-Tenant Isolation

Control Objective: Prevent cross-tenant data leakage and unauthorized access.

  • Hard tenant scoping in all APIs
  • Database-level tenant isolation
  • Routing metadata access controls
  • Tenant boundary test coverage

Baseline Control Domains

Control Domain Baseline Requirement Primary Owner
Governance and Risk Security policy set, risk register, quarterly reviews Security & Compliance
Identity and Access Management SSO + MFA, least privilege RBAC, access reviews Security & Engineering
Session and Token Security Short-lived tokens, secure cookies, CSRF protection Engineering
Tenant Isolation Hard tenant scoping in APIs and data access Engineering
Secrets and Key Management Managed vault storage, rotation schedules, no secret leakage Security & Engineering
Data Protection and Privacy Data minimization, retention windows, DSAR handling Legal & Privacy
Logging and Monitoring Immutable security logs, abuse pattern alerts Security & Engineering
Vulnerability Management Dependency and code scanning, severity-based remediation Security & Engineering
Incident Response Severity model, response workflow, post-incident reviews Security & Compliance
Resilience and Recovery Backup and restore testing, recovery objectives Engineering & Platform Ops
Secure SDLC Peer review, CI checks, release approvals Engineering
Third-Party Risk Vendor security reviews, contract controls Security, Legal, Partnerships

Cryptographic Controls

All cryptographic operations follow industry best practices with regular rotation schedules:

  • TLS 1.2+ for all network communications
  • SAML certificate signing and encryption
  • OIDC JWT signing keys (JWKS)
  • Database encryption at rest
  • Secrets vault encryption

Security Monitoring

Comprehensive logging and alerting to detect and respond to security events:

  • Authentication and authorization failures
  • Tenant boundary violations
  • Unusual partner routing patterns
  • API rate limit triggers
  • Secret access and rotation events

Operational Runbooks

Documented procedures ensure consistent and effective security operations:

  • Incident Response Procedures
  • Vulnerability Management Workflow
  • Secrets and Key Rotation Schedule
  • Backup and Disaster Recovery
  • Access Review and Provisioning

Architectural Decision Framework

Our security baseline is grounded in rigorous architectural decision-making with documented rationale, trade-off analysis, and continuous review cycles.

Design Principles

  • Defense-in-depth security layers
  • Fail-closed by default
  • Least privilege access model
  • Zero-trust network assumptions

Architecture Governance

  • Documented decision rationale
  • Trade-off and risk analysis
  • Peer review and validation
  • Regular architecture review cycles

Implementation Standards

  • Industry best practices alignment
  • Testable security controls
  • Observable failure modes
  • Compliance-first design

Security Program Artifacts

Minimum required artifacts maintained and reviewed quarterly:

Policy Documentation

  • Information Security Policy
  • Privacy and Data Handling Policy
  • Access Control Standard
  • Logging and Monitoring Standard
  • Secure SDLC Standard

Operational Procedures

  • Vulnerability Management Runbook
  • Incident Response Runbook
  • Backup and Recovery Runbook
  • Secrets and Key Rotation Runbook
  • Vendor Risk Review Procedure

Evidence Records

  • Risk Register and Treatment Plans
  • Security Scan Reports
  • Access Review Logs
  • Incident Post-Mortems
  • Training Completion Records

Security Baseline Review: Quarterly by Security and Compliance team. Architecture governance maintained through continuous review and validation cycles.