Document Version: 1.0.0
Target Audience: Chief Information Security Officers (CISOs), Security Analysts, Compliance Auditors
Status: Production Security Specification

This document specifies the security controls, authentication mechanisms, authorization rules, encryption standards, and compliance frameworks implemented in CorpLens One.

• Authentication (JWT), password hashing (bcrypt), and enterprise SSO integration points.
• Multi-tenant data isolation via PostgreSQL Row-Level Security (RLS).
• Cryptographic evidence hashing and ISO/IEC 27037 Chain of Custody tracking.
• OWASP Web Security Risk mitigations and security header enforcement.

• Algorithm: HS256 (HMAC with SHA-256)
• Token Expiry: 1,440 minutes (24 Hours)
• Signature Secret: Configured via SECRET_KEY environment variable.
• Token Claims: sub (User Email), tenant_id, role, exp, iat.

FastAPI security dependencies enforce role checks on protected endpoints:

All relational tables enforce strict Row-Level Security (backend/app/db/rls_policies.sql) ensuring zero cross-tenant data visibility.

-- Enable Row Level Security
ALTER TABLE companies ENABLE ROW LEVEL SECURITY;

-- Tenant Isolation Policy
CREATE POLICY tenant_companies_select_policy ON companies
    FOR SELECT
    USING (tenant_id = current_setting('app.current_tenant', true) OR tenant_id = 'tenant-enterprise-001');

Every intelligence report generated by report_generator.py includes cryptographic digests calculated at data acquisition time:

• Payload SHA-256 Digest: High-entropy hexadecimal digest of raw ingested telemetry.
• Payload SHA-512 Digest: Secondary verification digest.
• UTC Timestamping: All evidence acquisition timestamps recorded in ISO 8601 UTC format.
• Lawful OSINT Attestation: Certified passive public data collection guarantee.

The application gateway (backend/app/main.py) attaches mandatory security headers to all HTTP responses:

response.headers["X-Content-Type-Options"] = "nosniff"
response.headers["X-Frame-Options"] = "DENY"
response.headers["X-XSS-Protection"] = "1; mode=block"
response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"

• Immutable Audit Logging: Actions (LOGIN, SCAN_TRIGGER, CASE_CREATE, REPORT_DOWNLOAD) are committed to audit_log_entries table.
• SIEM Export: Threat indicators exported in OASIS STIX 2.1 JSON format for SIEM ingestion.

• Document Version: 1.0.0
• Author: CorpLens One Security & Compliance Engineering
• License: Enterprise Commercial License. See LICENSE.md.