Tenant isolation
PostgreSQL row-level security is enabled and forced. Object keys carry a tenant prefix, and application adapters reject a mismatched requesting tenant.
Security and data governance
Evidence integrity starts below the dashboard.
MassTrail’s implementation baseline isolates tenants at the database and object layers, preserves raw evidence, and makes every privileged action visible. Production controls remain subject to design-partner security review and independent testing.
Append-only evidence
Raw envelopes, canonical observations, audit events and locked close snapshots reject update and delete. Corrections reference prior events.
Source integrity
Original bytes are hashed before parsing. Stable source keys, parser versions, timestamps and replay conflicts remain attached.
Registered devices
ProofNode contracts require unique credentials, revocation, encrypted offline queues, sequence/idempotency and health state.
Least privilege
Customer, site, device, reviewer and support roles are separate. Production support requires a time-bound customer grant.
Reproducible close
Canonical JSON and ordered hash-chain manifests bind evidence, mappings, rules, dispositions and approvals to each snapshot.
Current implementation proof
Negative paths are part of done.
The repository carries tenant-negative vault tests, RLS pgTAP coverage, idempotent replay conflict tests, manifest determinism, blind-reveal integrity and encrypted ProofNode queue tamper checks.
Before production customer data
- Provider and South African data-transfer review
- Enterprise OIDC/SAML and privileged-role MFA
- Independent penetration test and issue closure
- Backup restore, device replay and incident exercises
- POPIA role map, retention and cross-border assessment
- Signed DPA, security schedule and sub-processor list
Cryptographic tamper evidence can show that recorded bytes changed. It cannot prove a load’s contents, an instrument’s calibration, or a legal claim. Those limitations remain visible in the product and pack.