Security
ModelCop is built to a secure-by-design, prove-every-claim standard. Isolation boundaries, alerting, and recovery procedures are verified — not just diagrammed.
00 · Posture at a glance
Encryption in transit and at rest, three-layer tenant isolation, audit logging, threat detection, and a validated disaster-recovery runbook. We are explicit about what is live today versus on the roadmap.
01 · Tenant isolation
ModelCop is multi-tenant at the application layer but enforces tenant boundaries at the database layer, with multiple independent mechanisms. Tenant context is strict and request-scoped: any code path that reaches the database without an active tenant raises an explicit error rather than defaulting to a tenant.
The app connects under a dedicated, least-privilege role that cannot bypass row-level security. Every tenant-scoped table enforces PostgreSQL Row-Level Security with force enabled, so the engine itself refuses rows outside the active tenant. An automated isolation test suite runs on every deploy.
02 · Defense in depth
| Layer | Controls |
|---|---|
| Network | VPC-isolated; application and database in private subnets with no public IPs. A single load balancer is internet-facing, behind a managed web application firewall. |
| Transport | TLS 1.2/1.3 only; older protocols rejected. HTTP redirected to HTTPS; plaintext never served. Certificates auto-renew. |
| Application | OIDC single sign-on (no password storage), hardened session cookies (HttpOnly, Secure, SameSite), and least-privilege access. |
03 · Data protection
- At rest: database storage encrypted with AES-256; object storage encrypted with public access blocked at the account level.
- In transit: HTTPS externally and encrypted, certificate-verified connections to the database.
- Backups: continuous point-in-time recovery with 7-day retention; deletion protection enabled on the database cluster.
- Secrets: credentials and signing keys live in a managed secret store, read at runtime via scoped IAM roles, and rotated under operator control.
04 · Monitoring, detection & response
Management-plane activity, network flow logs, database logs, and application logs are captured to dedicated, access-controlled stores, with threat detection enabled across the environment.
05 · Disaster recovery
Recovery is validated end-to-end, not merely configured. A point-in-time restore exercise — new cluster, schema and role verification, tenant-isolation check, and teardown — has been completed and is re-validated periodically.
06 · Vulnerability management
Container images are scanned on every push; the current image carries no critical, high, medium, or low findings. Dependencies are pinned and reviewed before merge.
07 · Compliance posture
| Item | Status | Detail |
|---|---|---|
| Encryption & isolation | Live | AES-256 at rest, TLS in transit, 3-layer tenant isolation |
| Audit & threat detection | Live | Management-plane audit log, flow logs, threat detection |
| SOC 2 Type II | In progress | Readiness underway; target Q4 2026 |
| ISO/IEC 42001 | In observation | AI-management-system controls implemented |
| HIPAA-eligible architecture | On enterprise | BAA available; structured for PHI workloads |
| GDPR data-subject rights | Live | Per-tenant export and deletion |
| Third-party pen test | Planned | Scheduled post-launch |
| FedRAMP | Not planned | Out of scope at this stage |
08 · Responsible disclosure
Report a vulnerability via our Responsible Disclosure page or security@modelcop.ai. We acknowledge reports within one business day.