How LoopProof holds your data

Tenant isolation

Each tenant has its own PostgreSQL schema and database role. The application login role, loopproof_app, may only execute the functions exposed for its role: no direct SELECT on any table. A query that crosses a schema boundary is a SQL error, not a permission decision in application code.

Tenant secrets (the ExternalId for the connector role and the Linear OAuth tokens) are in Secrets Manager under loopproof/<env>/tenants/<tenant-key>/. The API's task role may read and write them; no other role may without an explicit grant.

Connector security

The connector module creates an IAM role in the tenant's account that LoopProof assumes with sts:AssumeRole. The trust policy requires the tenant's ExternalId, which LoopProof generates at random and stores in Secrets Manager. No static credentials, no access key, no long-lived session token.

The connector role's only permissions are reading Security Hub findings and forwarding events to LoopProof's EventBridge bus.

IAM database authentication

LoopProof's task roles log in to PostgreSQL with IAM auth tokens, not passwords. The RDS instance accepts only token-authenticated connections for the application login roles. There is no database password to rotate, leak or guess.

Break-glass access

An operator's access to a tenant's data is a break-glass admin command. It is:

• Time-limited: the operator sets an expiry when opening a grant, up to a configurable maximum.
• Read-only: the break-glass login role has membership of the tenant's database role with no write privileges.
• Recorded: every query, its result, the operator identity and the reason are in the tenant's audit trail.
• Tenant-notified: the tenant's admins receive an email when a grant opens.

Offboarding and data deletion

When a tenant leaves, the offboarding process deletes everything LoopProof holds: the tenant's schema and database role, all rows in shared tables, Cognito users with no other tenant, the ExternalId and Linear secrets, and every version of every object in the tenant's archive prefix in S3.

The drop is verified empty before it is recorded. Automated backups expire within 7 days. Everything is gone within 30 days of the drop.

Archive integrity

The raw event archive is write-once: the S3 bucket policy refuses a PutObject without If-None-Match: *, so an existing object is never replaced. Versioning is on. Noncurrent versions are kept for 90 days. The bucket policy denies s3:DeleteObject to every principal except offboarding's task role.

Compliance

InfraHouse holds no SOC 2 report for LoopProof. LoopProof runs in us-west-1. Data in transit uses TLS 1.2 or higher.