Security & compliance posture

Siphon targets healthcare CMMS/EAM data (the wedge), so a buyer's security review is a first-class concern. This page states the posture plainly: what's built, and what's in progress. No overclaiming.

Built today

• Encryption in transit & at rest. All source/destination credentials are envelope-encrypted (AES-256-GCM) with a KEK; plaintext secrets are never written to logs, the Restate journal, or the client bundle. TLS everywhere.
• Tenant isolation. Org → workspace → connection scoping is enforced in the service layer; an IDOR regression test proves cross-tenant reads are denied. Row-level security policies exist at the database layer (ADR-0013) as belt-and-suspenders.
• Least-data delivery. Bring-your-own-warehouse (BYO Postgres / SQL Server) keeps the buyer's data in their own environment; Siphon can run fully self-hosted or BYOC (ADR-0008) for data-residency / air-gapped requirements.
• Auditability. An append-only audit log records spec publishes, connection changes, key rotations, and replays. Every sync run is inspectable (call timeline, quarantine, redacted request/response logging).
• Egress control. SSRF guard on outbound/destination connections (private/reserved address blocking). Per-connection rate limiting.
• Access control. Magic-link auth + per-workspace RBAC (ADR-0016); short-lived, connection-scoped embed tokens so a customer widget only ever sees its own connection.
• Data-tool posture. The internal agentic tooling defaults to local-first (ChunkHound, zero egress) and gates cloud tools on a data-handling review before they touch PHI-adjacent code.

In progress / required for a healthcare close

• HIPAA / BAA. A signed Business Associate Agreement is required before processing PHI. Asset + work-order data is often not PHI, but treat it as in-scope until confirmed. Status: BAA process to establish.
• SOC 2. Type II evidence assembly (access reviews, change management, monitoring, incident response). Status: scoping.
• RLS activation. The policies exist; enforcing them requires the app to connect as a dedicated non-superuser DB role (a superuser bypasses RLS). Status: an ops decision — provision the role + repoint DATABASE_URL.
• Penetration test + vulnerability management cadence. Status: planned.