{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Security Concepts","description":"Developer documentation for integrating systems that send messages, plus reporting and operational APIs for platform holders."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-concepts","__idx":0},"children":["Security Concepts"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"purpose","__idx":1},"children":["Purpose"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section describes the main security principles applied by the platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["It focuses on conceptual security mechanisms rather than operational procedures."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication","__idx":2},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All API access requires authentication."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform supports:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Machine to machine authentication using certificates and JWT"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["User authentication using OAuth flows"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authentication tokens are required for all protected endpoints."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authorization","__idx":3},"children":["Authorization"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorization is enforced using:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Organisation boundaries"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sender identity permissions"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Role based access control"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["API specific scopes"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access is evaluated for each request."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"transport-security","__idx":4},"children":["Transport Security"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All external communication uses encrypted transport."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["TLS is enforced for:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["API endpoints"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication services"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["File access services"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Unencrypted connections are not supported."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"data-encryption","__idx":5},"children":["Data Encryption"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform applies encryption at multiple levels:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transport encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Storage encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Recipient specific content encryption"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When sender side encryption is used, files are decrypted for processing and re encrypted for recipients."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"key-management","__idx":6},"children":["Key Management"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Encryption keys are managed within the platform."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keys are:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Generated per content item"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Isolated per recipient"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Protected from direct access"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Senders do not receive recipient encryption keys."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"integrity-protection","__idx":7},"children":["Integrity Protection"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform supports integrity verification through:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Hash validation"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authenticated encryption modes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Schema validation"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When hashes are provided, content integrity is verified before processing."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"audit-logging","__idx":8},"children":["Audit Logging"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security relevant events are logged, including:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authentication attempts"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access operations"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Administrative changes"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Delivery failures"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Audit data is available through the Log API."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"isolation","__idx":9},"children":["Isolation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The platform enforces isolation between:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Organisation accounts"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sender identities"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Receivers"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Data and access are separated according to organisational boundaries."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"incident-handling","__idx":10},"children":["Incident Handling"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Security incidents are handled according to governance procedures."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Operational processes are outside the scope of this documentation."," ","Security incidents are handled according to platform governance procedures."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Details of operational processes are outside the scope of this documentation."]}]},"headings":[{"value":"Security Concepts","id":"security-concepts","depth":1},{"value":"Purpose","id":"purpose","depth":2},{"value":"Authentication","id":"authentication","depth":2},{"value":"Authorization","id":"authorization","depth":2},{"value":"Transport Security","id":"transport-security","depth":2},{"value":"Data Encryption","id":"data-encryption","depth":2},{"value":"Key Management","id":"key-management","depth":2},{"value":"Integrity Protection","id":"integrity-protection","depth":2},{"value":"Audit Logging","id":"audit-logging","depth":2},{"value":"Isolation","id":"isolation","depth":2},{"value":"Incident Handling","id":"incident-handling","depth":2}],"frontmatter":{"seo":{"title":"Security Concepts"}},"lastModified":"2026-02-02T19:10:15.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/introduction/security-concepts","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}