Architecture
How ModelCop is built: a multi-tenant control plane with isolation enforced at the database kernel, encryption everywhere, and a small, auditable attack surface.
Platform
- Application: Python 3.12 / FastAPI, running on AWS ECS Fargate (containerized, non-root, minimal image).
- Database: Aurora PostgreSQL Serverless v2, single cluster, encrypted storage.
- Front door: a single internet-facing load balancer behind AWS WAF; application and database live in private subnets with no public IPs.
Tenant isolation (three independent layers)
- Application: tenant context is strict and request-scoped — any query without an active tenant raises an explicit error rather than defaulting.
- Database role: the app connects under a least-privilege role that cannot bypass row-level security; the administrative role is never used to serve traffic.
- Database engine: every tenant-scoped table enforces PostgreSQL Row-Level Security with FORCE enabled, so the engine itself refuses cross-tenant rows. An automated isolation test suite runs on every deploy.
Data protection
- AES-256 encryption at rest; TLS 1.2/1.3 in transit; certificate-verified database connections.
- Secrets held in a managed secret store, read at runtime via scoped IAM roles.
- Continuous point-in-time recovery (7-day retention) with deletion protection on the cluster.
Monitoring & detection
Management-plane audit logging (CloudTrail), network flow logs, database logs, and application logs are captured to dedicated, access-controlled stores. Threat detection (GuardDuty) is enabled across the environment, and container images are scanned for vulnerabilities on every build.
Inline governance
ModelCop can sit inline between an agent and its LLM provider: point the provider base URL at ModelCop, and prompts are classified and checked against policy before they are forwarded — with a forensic record on every decision.
Disaster recovery
Recovery is validated end-to-end, not merely configured. A point-in-time restore exercise — new cluster, schema and role verification, tenant-isolation check, and teardown — has been completed and is re-validated periodically.
For a deeper walkthrough, request our Security & Compliance Overview at security@modelcop.ai.