Security posture

Authentication & authorization

• Per-tenant signed JWTs (HS256, 5-minute TTL) — every dashboard → API request carries a freshly-signed token with explicit sub=operator_id and aud=kural-api claims. Replaces the previous shared- bearer model so a single token leak no longer = god-mode.
• Tenant-scope enforcement: API routes that operate on a tenant compare the JWT's operator_id against the URL path's operatorId and return 403 on mismatch.
• Public allowlist is positive: /health, /stats, /controls, OAuth callbacks, and auditor-token-gated /api/external-share/access/ paths are the only routes that bypass JWT. Everything else is 401-by- default.

Multi-tenant data isolation

• Postgres Row-Level Security on 25 tenant-scoped tables — including SuspiciousActivityReport, NoSarDecision, ResolutionRequest, ScreeningEvent, GamstopCheck, EvidenceRecord, StaffTrainingRecord. Policy: tenant_isolation with USING (operator_id = current_setting('app.tenant_id')).
• Application-side withTenant() — every tenant-scoped operation wraps Prisma queries in a transaction that runs SET LOCAL app.tenant_id = $1 first. The wrapper rejects operator_id values that don't match a strict allowlist regex (defence against SQL-injection into the GUC name).
• Cross-tenant penetration test: a SQL script in packages/db/rls/test-cross-tenant.sql connects as the application role with one tenant's context and asserts that SELECT on every protected table returns 0 rows for any other tenant.

Outbound HTTP guardrails

• SSRF guard on every operator-supplied URL — rejects RFC 1918, loopback, link-local, IPv4-mapped IPv6, decimal/octal/hex-encoded IP literals, cloud-metadata addresses, CGNAT, TEST-NET, and known internal-service ports.
• Dual-resolve check: hostname is resolved twice; if the second resolve returns a different address, the request is rejected (DNS-rebinding defence).
• IP-pinned outbound fetch: safeFetch() uses a custom undici Dispatcher with a lookup callback that returns the pre-verified IP, so a TOCTOU rebinding between guard-check and connect time cannot redirect the live connection. Redirects are disabled (a redirect re-does DNS).

Document ingestion & LLM boundary

• Raw PDF bytes are never sent to any LLM provider. When an operator drops a certification PDF, our pipeline (a) checks the %PDF- magic-byte prefix, (b) rasterizes the PDF to PNG images via pdftocairo running inside the API container with no network egress, (c) caps the document at 20 pages, and (d) sends only the rasterized images to Claude vision. Text layers, embedded scripts, OCR-resistant invisible instructions — all discarded at the raster step.
• Prompt sandwich: the rasterized images are wrapped in <<<DOCUMENT-START>>> ... <<<DOCUMENT-END>>> delimiters with an explicit system instruction that any text inside is to be read as data, never as command.
• Output is tool-call-only: the model is forced to respond by calling submit_cert_extraction with the structured schema; free-form text replies are not parsed.
• Reviewer-in-the-loop: every extraction lands in status="needs_review" on the operator's dashboard with per-field confidence badges. No automated write to the evidence ledger without human confirm.

External-share (auditor) surface

• Positive-allowlist redaction: the audit-token endpoint emits only tables + columns explicitly listed in packages/db/audit-share-allowlist.yaml. Default-deny on any new table. A CI gate (pnpm audit-share:validate) fails any PR that adds a Prisma model without an explicit include/exclude decision.
• POCA s.333A tipping-off filter: every emitted table that joins to findings is filtered by collectTippingOffFindingIds() — Findings with an attached SAR or No-SAR decision are stripped from the auditor's view. EvidenceRecord rows with evidence_type ∈ SAR_EVIDENCE_TYPES are stripped too.
• Time-bounded, watermarked, access-logged: every grant has an expiry, a recipient email, a purpose, and writes a row to ExternalShareAccessLog on every access.
• Independent verification: the auditor can recompute every Merkle proof against the chain head without KURAL servers — the verify endpoint is read-only and the proof format is open (Merkle tree per RFC 6962 + RFC 3161 timestamps).

Evidence-ledger integrity

• Append-only Merkle chain: every evidence record has SHA-256 merkle_root + prev_chain_hash + chain_hash. Tampering with any historical record invalidates every subsequent chain hash.
• Dual RFC 3161 timestamps: chain heads are periodically anchored to DigiCert (US, commercial) and FreeTSA (EU, NGO) trusted timestamping authorities. Operators get two independent attestations of the chain's existence-at-time.
• RFC 4998 Evidence Record Syntax compatible: the Merkle + RFC 3161 primitives are the same ones banks use for ten-year transaction archives audited by the ECB.

Sub-processor chain & data residency

• Primary hosting in EU (Hetzner Falkenstein DE) — single-region today. Helsinki FI warm-standby is on the Q3 2026 roadmap; a one-line current-deployment topology lives on /trust/posture. UK GDPR adequacy via the DE adequacy decision — no UK-region infrastructure required for LCCP 1.1.x evidence retention. No data leaves the EU for storage purposes.
• Claude API calls (Anthropic, US) carry only public regulator text + rasterized PDF images that the operator has classified as Tier-A or Tier-B data. SAR content, raw KYC, identified player PII are contractually excluded from KURAL processing during the free-pilot phase.
• Full sub-processor list with purpose, location, and safeguards: /legal/subprocessors.

Incident response

• Runbook: published at docs/security/INCIDENT-RESPONSE.md in the source repo. Covers detection, triage, containment, eradication, recovery, post-mortem. First quarterly tabletop exercise: July 2026.
• Breach notification: GDPR Art. 33 — 72 hours to supervisory authority + affected controllers. Internal trigger: any unauthorised access to a tenant-scoped table, any cross- tenant data read, any LLM hallucination written to the evidence ledger without reviewer confirm.
• Status page + uptime: status.kural.tech. Sev-1/Sev-2 incidents posted in real time; post-mortems within 7 calendar days.

Certifications & assurance — in flight

Responsible disclosure

Found something? Email security@kural.tech with PGP key fingerprint listed at kural.tech/.well-known/security.txt. We respond within 24 hours, fix within agreed SLAs, and publish a CVE if applicable. Bug-bounty programme on Intigriti launches Q3 2026 with a €15k initial pool.

Questions

Email security@kural.tech or privacy@kural.tech for DPA / sub-processor questions. We respond within 5 business days.