Security, Infrastructure & OperationsInfrastructureAWS (Enterprise Model)
AWS Services Used
Both models use S3, API Gateway, Lambda, and CloudWatch Logs. The difference: shared infrastructure (Shared) vs. dedicated per client (Enterprise).
AWS Services per Deployment Model
The AWS services used differ depending on the deployment model — Shared (multi-tenant on Heroku) or Enterprise (dedicated AWS infrastructure).
Shared Model (SaaS)
The Shared Model uses AWS microservices for processing, storage, and logging, within an infrastructure shared with other clients.
| AWS Service | Role | Key Configuration |
|---|---|---|
| AWS S3 — Primary bucket | Document content storage | Versioning enabled; SSE; Block-public-access ON; lifecycle delete markers 100 days |
| AWS S3 — CRR Replica | Passive backup/DR cross-region | Managed replica; SSE; no application reads/writes directly |
| AWS API Gateway | Proxy for Lambda microservices | HTTPS routes; request authentication/authorization; throttling |
| AWS Lambda | Stateless microservice functions | IAM-scoped; VPC/private endpoints |
| AWS CloudWatch Logs | Signing audit log | Append-only; encrypted at rest; 5-year retention |
S3 Access Flow — Shared Model
Web dyno (application)
│ HTTPS (least-privilege IAM credentials)
▼
AWS S3 Primary bucket
│ CRR managed automatically
▼
AWS S3 CRR Replica (different region — backup only)AWS Services Not Used in the Shared Model
| Service | Reason |
|---|---|
| AWS RDS | The database is Heroku Postgres (managed) |
| AWS CloudFront | No CDN is used |
| AWS SES | Transactional email is through Postmark |
| AWS Route 53 | DNS is managed through Heroku |
Enterprise Model (Dedicated Infrastructure)
The Enterprise Model uses an extended suite of AWS services, configured dedicated per client, according to contractual specifications.
| AWS Service | Role | Key Configuration |
|---|---|---|
| AWS RDS PostgreSQL | Main relational database | Dedicated per client; encrypted at rest (KMS); automatic daily backup (30-day retention) + PITR |
| AWS ElastiCache (Redis) | Application cache + asynchronous job queue | Dedicated per client; encrypted at rest (KMS); private in VPC |
| AWS S3 — Primary bucket | Document content storage | Versioning enabled; SSE; Block-public-access ON; lifecycle delete markers 100 days |
| AWS S3 — CRR Replica | Passive backup/DR | Managed cross-region replica; SSE; no application reads/writes directly |
| AWS ECS | Application containers and asynchronous jobs | Dedicated clusters per client; IAM task roles |
| AWS API Gateway | API proxy and routing | HTTPS routes; request authentication/authorization; throttling and usage plans |
| AWS Lambda | Stateless processing functions | IAM-scoped; VPC/private endpoints; versioned deployments |
| AWS SES | Transactional email | Notifications, OTP, system alerts; domain verified per client |
| AWS CloudWatch Logs | Signing audit log + application logs | 5-year retention (signing); append-only; encrypted at rest; IAM-restricted |
Access and Authentication (Both Models)
- Access to AWS services is done through least-privilege IAM credentials — each component has the minimum permissions necessary
- Credentials are stored securely in the application's environment variables — not in the source code
- 2FA mandatory on the administrative AWS account
- Access to S3 exclusively through authenticated API — no direct public exposure