Schema-level tenant isolation
Not application-level filtering.
Technology · Trust · Whitepaper
Where your data is is a parameter.
Security posture, tenancy model, encryption, retention and physical data location — stated concretely enough to be assessed. Where we have not yet done something, this page says so rather than implying otherwise.
01 / Problem statement
What this has to solve.
Field data is unusually sensitive in ways that are easy to underestimate.
Position history is a pattern of life. Where a person went, when, and with whom, over months. For a defense or resource customer this is the most sensitive dataset they will generate.
Health data is health data. Vitals from a wearable are medical information in most jurisdictions, whatever a terms-of-service page calls them.
Organization layers are commercially confidential. A lease boundary or a cut-block outline is competitive information, and it is being distributed to devices that get lost.
02 / Mechanism
The design, component by component.
- Tenancy
- Tenant partitioning in the schema, with tenant scope enforced at the query layer rather than by application-level filtering that a missed WHERE clause defeats.
- Authorization
- Role-based access control across users, groups, organizations and tenants. Authorization is checked at the ingest boundary on every operation, not once at login.
- Encryption in transit
- TLS for IP transports. Per-message keys with forward secrecy over mesh, which is a stronger property than TLS provides for the equivalent traffic.
- Encryption at rest
- Database and local-store encryption, using a FIPS 140-3 validated module in an Enterprise deployment. The module is the module vendor’s validation, not ours, and we document which one.
- Device loss
- Local stores are encrypted, sessions are revocable centrally, and an organization can revoke a device without waiting for it to reconnect.
- Privacy scope
- What a member shares is the member’s decision, including what travels through another member’s radio on the mesh. Health data defaults to private.
- Retention
- Configurable per tenant, with a documented default. Position history retention is the parameter most customers change first, and we make it easy to shorten.
- Data location
- A deployment parameter. In an air-gapped deployment, data never leaves the network — which is a stronger guarantee than any residency clause.
- Audit
- Every user and administrative action recorded with actor, timestamp and origin, including failed attempts, exportable on Enterprise.
- Disclosure
- Security issues are addressed and disclosed. We do not have a public bug bounty yet, and we are not going to pretend otherwise.
03 / Properties
What this guarantees.
Authorization at every ingest
Not once at login.
Forward secrecy over mesh
Per-message keys.
Revocable devices
Without waiting for the device to reconnect.
Member-controlled privacy
Health data private by default.
Configurable retention
Shortening it is a setting, not a support ticket.
Data location as a parameter
Up to and including no egress at all.
Exportable audit trail
Including failures.
04 / Reference
| Control | Free / Pro | Elite | Enterprise |
|---|---|---|---|
| TLS in transit | ● | ● | ● |
| Local store encryption | ● | ● | ● |
| Forward secrecy over mesh | ● | ● | ● |
| RBAC | ● | ● | ● |
| Member privacy controls | ● | ● | ● |
| Configurable retention | ○ | ● | ● |
| Central device revocation | ○ | ● | ● |
| Audit logging | ○ | ○ | ● |
| SSO / SAML | ○ | ○ | ● |
| FIPS-validated module | ○ | ○ | ● |
| Data location control | ○ | ○ | ● |
| Air-gapped deployment | ○ | ○ | ● |
05 / Process
Traced, node by node.
Assess it, do not trust it.
Ask us for the security documentation. We will send what exists and say what does not.