Firewall and WAF
Shared Model — layered compensating controls instead of a WAF; Dedicated Model — optional AWS WAF
Context
The approach to the application firewall differs between the two deployment models:
Shared Model (SaaS)
The platform runs on Heroku, which does not include a Web Application Firewall in the shared dyno model. The protections that a WAF would typically provide are implemented through layered controls at the platform, framework, application, and observability levels (see the table below).
Enterprise Model (Dedicated)
In the per-client dedicated AWS infrastructure, AWS WAF is optionally available as an AWS-managed application firewall (see the Dedicated Model — AWS WAF section). The layered application- and framework-level controls remain active in both models.
Shared Model — Compensating Controls
The document below is approved as a substitute for a WAF in the Shared (multi-tenant) model. Version: 1.0 | Approval date: 2026-04-29.
| WAF Function | Substitute Control(s) in Place |
|---|---|
| TLS Termination & HTTPS Enforcement | Heroku Router with Let's Encrypt wildcard certificates (managed by the technical support team); TLS 1.2+; HTTPS enforced in application configuration; HSTS header enabled |
| Security Response Headers | Security headers configured at the application level: HSTS, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy |
| OWASP Top 10 — injection, XSS, CSRF | Protections built into the web framework: CSRF token verification on any state-changing request; automatic HTML output escaping (XSS); parameterized database queries (SQL injection); explicit input validation and filtering |
| File Upload Abuse | Uploaded files are validated by type — allowed extensions only, size limits, and MIME type verification for sensitive uploads |
| Authentication Brute-Force / Credential Stuffing | Account lockout after 10 failed attempts, with a counter shared between password and 2FA code and a warning on the 9th attempt; unlocking requires a user action (email link or completing a password reset) — the lock does not expire with time; session timeout; authentication audit; password length policy (8–128 characters); optional TOTP 2FA (code from an authenticator app or sent by email); federated SSO (per-organization OIDC in Shared; domain-based SAML in Enterprise) — see Local Authentication and 2FA |
| Rate / IP Throttling | Authentication-level throttling via the account lockout mechanism (10 failed attempts). IP/rate-based throttling middleware was evaluated — it was not enabled because no abuse issues were observed that would justify adding it. Heroku platform-level DDoS protection and AWS API Gateway throttling are used for microservice calls |
| Vulnerable Dependencies | Static application security testing (SAST) and dependency vulnerability scanning; findings are triaged and remediated within the development cycle |
| Attack Pattern / Anomaly Detection | Application error rate alert policies (New Relic) providing anomaly detection signals; runtime exception monitoring (Sentry); client activity logs (Postgres, 3-month retention) accessible to tenant administrators; signing audit trail in AWS CloudWatch Logs (5-year retention) |
| Network / Edge DDoS | Heroku platform-level DDoS protection (provider-managed); AWS API Gateway — request throttling and usage plans for microservice traffic |
| Object Storage Exposure | AWS S3 Block Public Access enabled; server-side encryption (SSE); access exclusively through authenticated API; the cross-region replica is a passive backup with no application access |
| Secrets / Credential Exposure | Application secrets stored exclusively in platform-managed environment variables (not included in source code); mandatory 2FA on GitHub, Heroku, AWS, and other administrative consoles; GitHub branch protection — mandatory PR review on the main branch |
Approval
The compensating controls listed above are approved as the current substitute for a WAF in the Shared deployment model. Date: 2026-04-29.
Dedicated Model — AWS WAF
In the per-client dedicated AWS infrastructure, perimeter protection can be provided directly through AWS WAF, optionally enabled based on the client's security requirements:
| Service | Role | Features |
|---|---|---|
| AWS WAF | Web Application Firewall in front of the application | Managed rules (including OWASP Top 10 / common rule sets), rate limiting, request-level filtering, IP/geographic blocking, protection against common attack patterns |
When enabled, this service complements the layered framework- and application-level controls (which remain active in both models) — it does not replace them. Unlike the Shared model, in the Dedicated model the application firewall is a dedicated service, not a set of compensating controls.