{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Security Concepts","description":"Developer documentation for integrating systems that send messages, plus reporting and operational APIs for platform holders."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-concepts","__idx":0},"children":["Security Concepts"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section describes the core security principles and mechanisms used by the Digital Post Platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["It explains how identities are protected, how data is secured, and how access is controlled throughout the message lifecycle."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The goal is to provide integrators with a clear understanding of how security is implemented at a conceptual level."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-objectives","__idx":1},"children":["Security Objectives"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform security model is designed to support the following objectives:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confidentiality of message content"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Integrity of data and metadata"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication of systems and users"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authorization of operations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Traceability and auditability"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Protection against unauthorized access"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All technical controls support these objectives."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-architecture-overview","__idx":2},"children":["Security Architecture Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security is implemented across multiple layers:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Identity and authentication"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authorization and access control"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transport security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Storage security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Application level validation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Operational monitoring"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each layer contributes to overall system protection."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["No single control is relied upon in isolation."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"identity-and-authentication","__idx":3},"children":["Identity and Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All access to platform APIs requires authenticated identities."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Two primary identity types exist:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["System identities for machine to machine integration"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["User identities for interactive access"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["System authentication is based on:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["X509 client certificates"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["JSON Web Tokens"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["OAuth 2.0 token exchange"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each system integration represents a unique technical client."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["User authentication uses external identity providers through standardized protocols."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"certificate-based-authentication","__idx":4},"children":["Certificate Based Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Machine authentication is based on public key cryptography."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each system integration is associated with:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A public certificate stored by the platform"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A private key held by the integrator"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The private key is used to sign authentication tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform validates signatures using the registered public certificate."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Private keys must never be shared."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Loss or compromise of a private key requires immediate revocation."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authorization-and-access-control","__idx":5},"children":["Authorization and Access Control"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authentication establishes identity."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorization determines what actions are permitted."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorization is enforced using:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Organisation context"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sender identity"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["System integration permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["API scope restrictions"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Permissions are evaluated for each request."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access is limited to resources owned by the authenticated organisation."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cross organisation access is not permitted unless explicitly configured."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"role-of-organisational-hierarchy","__idx":6},"children":["Role of Organisational Hierarchy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access control is aligned with the organisational model."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Permissions are inherited through the hierarchy."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This ensures that:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sub organisations cannot exceed parent permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Reporting boundaries are preserved"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Billing data remains isolated"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Audit visibility is controlled"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Understanding the organisational model is required to understand authorization behavior."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"transport-security","__idx":7},"children":["Transport Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All external communication uses encrypted transport channels."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["TLS secured HTTPS endpoints"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Certificate validation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Secure cipher suites"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Unencrypted connections are not supported."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Clients must verify server certificates to prevent interception."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"storage-security","__idx":8},"children":["Storage Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Message content and metadata are protected at rest."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Storage protection includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encrypted file storage"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encrypted databases"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Key management controls"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Restricted administrative access"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each message body and attachment is encrypted with a unique key."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Encryption keys are not shared between messages."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"client-side-encryption","__idx":9},"children":["Client Side Encryption"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Integrators may optionally encrypt files before upload."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When client side encryption is used:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Files are encrypted using AES 256"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encryption keys are managed by the integrator"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keys are provided during delivery creation"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform decrypts content for processing and re encrypts it for recipients."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This provides additional protection when using external storage services."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"message-level-security","__idx":10},"children":["Message Level Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each message is processed individually."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Message level protection includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Envelope validation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["File integrity checks"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hash verification"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encryption per artifact"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Recipient isolation"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Messages are never shared between recipients."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each recipient receives an independent encrypted copy."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"integrity-protection","__idx":11},"children":["Integrity Protection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Data integrity is enforced through multiple mechanisms."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Digital signatures on authentication tokens"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hash values in envelopes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transport encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encrypted storage"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If integrity checks fail, processing is aborted."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Corrupted messages are not delivered."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"malware-and-content-scanning","__idx":12},"children":["Malware and Content Scanning"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All uploaded content is scanned before delivery."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scanning includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Virus detection"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Malware analysis"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Signature matching"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Behavioral analysis"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If malicious content is detected:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Processing stops"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The envelope is rejected"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An error is recorded"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Infected content is never delivered."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"interim-repository-security","__idx":13},"children":["Interim Repository Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Messages stored in the interim repository are protected using the same controls as delivered messages."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access isolation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Limited retention"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Controlled notifications"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only the intended recipient may access interim messages after account creation."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"logging-and-auditability","__idx":14},"children":["Logging and Auditability"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security relevant events are logged throughout the platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Logged events include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication attempts"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Token exchanges"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Delivery creation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Processing failures"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access operations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Administrative changes"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Logs are protected from modification."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Audit records support compliance and incident analysis."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"monitoring-and-incident-detection","__idx":15},"children":["Monitoring and Incident Detection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform continuously monitors operational and security signals."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Monitoring includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication anomalies"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Excessive failures"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Unusual access patterns"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Traffic spikes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["System integrity signals"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Alerts are generated when thresholds are exceeded."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Detected incidents are investigated according to internal procedures."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"data-isolation","__idx":16},"children":["Data Isolation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each organisation operates in an isolated context."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Isolation applies to:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Message content"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Metadata"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Logs"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Reports"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Billing data"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["No organisation can access another organisation’s data."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Isolation is enforced at multiple technical layers."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"error-handling-and-information-disclosure","__idx":17},"children":["Error Handling and Information Disclosure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Error responses are designed to minimize information exposure."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Responses include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Standardized error codes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["High level descriptions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Correlation identifiers"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Internal system details are not exposed."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sensitive information is never returned in API responses."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"key-management","__idx":18},"children":["Key Management"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cryptographic keys are managed using controlled processes."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Secure generation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Restricted access"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Rotation policies"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Backup procedures"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Revocation mechanisms"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Key access is limited to authorized platform components."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Integrators are responsible for protecting their own private keys."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"regulatory-and-compliance-alignment","__idx":19},"children":["Regulatory and Compliance Alignment"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security controls support regulatory requirements in applicable markets."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This includes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Data protection regulations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Financial compliance rules"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Audit obligations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Retention policies"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Specific regulatory obligations are defined by platform holders."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-responsibilities","__idx":20},"children":["Security Responsibilities"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security is shared between the platform and integrators."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Platform responsibilities include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Infrastructure protection"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Core encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access enforcement"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Monitoring"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Incident response"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Integrator responsibilities include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Protecting private keys"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Securing integration systems"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Managing credentials"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Implementing secure storage"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Monitoring integration behavior"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Failure on either side may impact security."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"security-best-practices-for-integrators","__idx":21},"children":["Security Best Practices for Integrators"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Recommended practices include:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store private keys in secure hardware or vaults"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Rotate certificates regularly"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Monitor authentication failures"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Validate all responses"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Protect access tokens"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Implement least privilege permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Log integration activity"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Review audit reports"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These practices improve overall system security."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"relationship-to-other-documentation","__idx":22},"children":["Relationship to Other Documentation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section complements:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication Setup"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Organisational Model"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Message Lifecycle"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Delivery Model"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Error Handling"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Together, these sections describe how the platform maintains trust and protection."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-documentation","__idx":23},"children":["Related Documentation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more information, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication Setup"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Message Lifecycle"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Message Delivery Model"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Error Handling Guide"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["API Reference"]}]}]},"headings":[{"value":"Security Concepts","id":"security-concepts","depth":1},{"value":"Security Objectives","id":"security-objectives","depth":2},{"value":"Security Architecture Overview","id":"security-architecture-overview","depth":2},{"value":"Identity and Authentication","id":"identity-and-authentication","depth":2},{"value":"Certificate Based Authentication","id":"certificate-based-authentication","depth":2},{"value":"Authorization and Access Control","id":"authorization-and-access-control","depth":2},{"value":"Role of Organisational Hierarchy","id":"role-of-organisational-hierarchy","depth":2},{"value":"Transport Security","id":"transport-security","depth":2},{"value":"Storage Security","id":"storage-security","depth":2},{"value":"Client Side Encryption","id":"client-side-encryption","depth":2},{"value":"Message Level Security","id":"message-level-security","depth":2},{"value":"Integrity Protection","id":"integrity-protection","depth":2},{"value":"Malware and Content Scanning","id":"malware-and-content-scanning","depth":2},{"value":"Interim Repository Security","id":"interim-repository-security","depth":2},{"value":"Logging and Auditability","id":"logging-and-auditability","depth":2},{"value":"Monitoring and Incident Detection","id":"monitoring-and-incident-detection","depth":2},{"value":"Data Isolation","id":"data-isolation","depth":2},{"value":"Error Handling and Information Disclosure","id":"error-handling-and-information-disclosure","depth":2},{"value":"Key Management","id":"key-management","depth":2},{"value":"Regulatory and Compliance Alignment","id":"regulatory-and-compliance-alignment","depth":2},{"value":"Security Responsibilities","id":"security-responsibilities","depth":2},{"value":"Security Best Practices for Integrators","id":"security-best-practices-for-integrators","depth":2},{"value":"Relationship to Other Documentation","id":"relationship-to-other-documentation","depth":2},{"value":"Related Documentation","id":"related-documentation","depth":2}],"frontmatter":{"title":"Security Concepts","description":"Understand the security architecture, controls, and protection mechanisms of the Digital Post Platform.","seo":{"title":"Security Concepts"}},"lastModified":"2026-02-03T18:35:23.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/documentation/security","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}