Security at Gillside

Architecture summary

OWASP Top 10 (2021) mitigations

Per-category review of how the platform mitigates each risk. Click a row to expand details.

• A01Broken Access ControlStrong

  Tenant-isolated authentication, role-checked handlers, row-level security, JWT-derived scoping.

  ▸
• A02Cryptographic FailuresStrong

  TLS 1.2+ end-to-end, encryption at rest on all stores, secrets gitignored + injected at deploy.

  ▸
• A03InjectionStrong

  Parameterized SQL, stdlib JSON only, no shell calls, automated SAST.

  ▸
• A04Insecure DesignStrong

  Tenant isolation by design, invite-only Tier-1, default-deny endpoints, cost guardrails.

  ▸
• A05Security MisconfigurationStrong

  No public S3, no defaults, error responses sanitized, security headers, GuardDuty + CloudTrail.

  ▸
• A06Vulnerable and Outdated ComponentsStrong

  Weekly dependency scans, AWS-managed runtimes, locked versions, automated CVE alerts.

  ▸
• A07Identification and Authentication FailuresMostly mitigated

  Cognito-managed credentials with rate limiting; MFA enforcement on admin accounts is the active gap.

  ▸
• A08Software and Data Integrity FailuresMostly mitigated

  No untrusted deserialization; CloudTrail integrity validation; secret scanning. Active: branch protection rules.

  ▸
• A09Security Logging and Monitoring FailuresStrong

  Structured logs everywhere, audit trail of mutations, multi-region CloudTrail, sensitive-event alarms, GuardDuty.

  ▸
• A10Server-Side Request Forgery (SSRF)Not applicable

  No user-controlled URLs in outbound HTTP — Lambda only fetches known endpoints (SendGrid, Cognito, CloudWatch, Mimir).

  ▸

Compliance & attestations

• SOC 2:Not yet attested. We follow the SOC 2 control framework as guidance; formal Type 1 attestation will be scoped when a customer pipeline justifies the cost (~$15-30k first year).
• GDPR:Data Processing Agreement template under development. Right-to-be-forgotten workflows will be supported per-tenant.
• Pen test:Annual third-party pen test scheduled for the first paying tenant onboarding window. Findings + remediations will be summarised here.
• Industry:Designed against OWASP Top 10 (above) + NIST CSF identifying-protect-detect-respond functions.