Isolation + audit verification surfaces
Security and audit pages map tenant safety, immutable logging, and evidence export boundaries.
Loading Settler...
Security Architecture
Security, Isolation, and Verifiable Evidence
Review the controls implemented in code, the checks enforced in CI, and the assurance work that remains specific to a live deployment.
MANIFEST_v2.4_SIGNED.json
SHA256_SEALED
"merkle_root": "7f4c8b...3e1a09",
"reconciliation_id": "rec_882f-119x",
"tolerance_drift": 0.0000,
"discrepancy_count": 0
Cryptographically Sealed
AUDIT READY
Security Architecture
Tenant Isolation
Repository, route, and authorization boundaries require tenant context. RLS definitions exist, while live database verification remains deployment-specific.
- PostgreSQL RLS definitions with live verification required
- API keys scoped to tenant context
- Server-side runtime tenant guards
Audit Trails
Implemented workflows record actors, timestamps, and decision context. Retention and write protections must be verified in the target deployment.
- Audit-event schema and service paths
- Actor, timestamp, and payload context
- Export surfaces for downstream review
Cryptographic Evidence
Configured runs can produce SHA-256 and Merkle evidence artifacts that support later integrity checks.
- SHA-256 evidence hashing
- Hash-linked run artifacts
- Independent verification tooling
Human-in-the-Loop Review
AI-assisted features are advisory. Approval requirements and operator authority depend on the configured workflow and policy.
- Manual override with documented reason
- Role-based review permissions
- Full review history retained
Access Controls
Role-based access control with principle of least privilege. Workspace admins control who can read, approve, and export reconciliation data.
- Owner / Admin / Reviewer / Viewer roles
- Workspace-scoped API keys
- SSO/OIDC capability is configuration-gated and verified per deployment
Deployment Boundary
Hosted, dedicated, and self-managed options have different data paths. The chosen architecture and operational responsibilities must be agreed before deployment.
- Local Docker development path
- Telemetry and export settings reviewed per deployment
- Open-core license boundary documented separately
Tenant Isolation Controls
Tenant identifiers are required across repository and route boundaries, with authorization checks, runtime guards, and RLS definitions providing layered controls. Live RLS and cross-tenant verification must still pass in the deployed database before launch.
TENANT_ID: PRD_001 AES-256 RLS ENFORCED
Engineered for high-integrity financial operations where every byte counts.
Compliance Readiness
Settler is not a compliance certification. It is infrastructure that makes compliance evidence collection tractable. The following implemented surfaces still require deployment-specific validation and do not establish certification.
- Audit-trail exports can support a broader SOC 2 evidence program
- Data-residency configuration surfaces require deployment validation
- Configurable retention policies for reconciliation records
- Role-separation between data access and configuration
- Webhook delivery with signed payloads for downstream audit systems
- AI data handling must be validated against the configured provider and deployment
Responsible Disclosure
Found a security vulnerability? Please report it privately with a sanitized reproduction. Reports are triaged according to the available support and incident process.
Security evidence references
Settler is built on verifiable truth. This registry connects marketing claims to concrete implementation modules, ensuring every capability is auditable.