Security Practices

1. Introduction

At SRVANT, the security of our systems and the sovereignty of your data are foundational to our architecture. This document outlines the security controls, practices, and architecture we employ to protect our infrastructure and your configurations. Our security posture is designed to meet and exceed the stringent requirements of enterprise compliance frameworks and industry best practices.

2. Architecture & Data Sovereignty

SRVANT operates on a distributed model designed to keep your sensitive telemetry data entirely within your control.

• Stateless Processing: The SRVANT Agent processes all data entirely in-memory. Customer logs are never written to persistent disk on our servers, ensuring your data cannot be inadvertently exposed at rest.
• Data Sovereignty: By deploying the agent inside your own infrastructure, you shape and filter traffic before egress. Raw, unfiltered data never leaves your VPC.
• Containerized Infrastructure: The SaaS Control Plane and API are strictly containerized and managed via Google Cloud Run, ensuring isolated, ephemeral, and scalable execution environments.

3. Cryptography & Data Protection

We implement strong cryptographic controls for data in transit and at rest.

• Data in Transit: All communication with the Control Plane (e.g., API requests and Agent synchronization) is forced over TLS 1.2+ as mandated by GCP Cloud Run load balancers.
• Data at Rest: Control plane configurations stored in our PostgreSQL databases utilize Google Cloud SQL's default AES-256 encryption at rest.
• Password Management: User passwords are cryptographically hashed using bcrypt with a cost factor of 10 prior to storage, protecting against brute-force and rainbow table attacks.

4. Access Control & Authentication

SRVANT implements strict logical access controls to prevent unauthorized access to the Control Plane.

• Multi-Factor Authentication (MFA): The Control Plane enforces MFA for all users via a one-time code sent to the registered email address prior to issuing an authentication token.
• Stateless Session Management: We utilize JSON Web Tokens (JWT) using the HS256 algorithm for secure, stateless session management. Tokens are securely verified by our API middleware.
• Role-Based Access Control (RBAC): Privileges are strictly segregated across Admin, Engineer, and Billing roles. Our API middleware enforces these roles, adhering to the principle of least privilege.
• Service-to-Service Authentication: Agent synchronization routes are protected via a dedicated token-based authentication middleware.

5. Operations Security & Auditing

We maintain comprehensive visibility into system operations and administrative actions.

• Comprehensive Audit Logging: The Control API implements a custom audit logger that records critical events. Logs capture the specific action, actor IP address (via X-Forwarded-For), actor role, user ID, account ID, and the target entities affected.
• Infrastructure as Code: Infrastructure deployments are strictly defined via declarative configurations and orchestrated through automated CI/CD pipelines.

6. Secure Development Lifecycle (SDLC)

Security is integrated directly into our software development lifecycle to prevent vulnerabilities from reaching production.

• Automated Security Scanning: Our CI/CD pipeline incorporates a dedicated security-scan stage. We utilize Static Application Security Testing (SAST) tools, including gosec for Go code and npm audit for Node.js dependencies, explicitly failing builds if high-severity vulnerabilities are detected.
• Deployment Security: Deployments utilize least-privilege service accounts to interact with container registries and deployment targets.

7. Contact Us

If you have questions or require further details regarding our security posture, please contact us at security@srvant.com.