Security, Privacy and Read-only Model

How identity, tenant isolation and customer AWS access are separated.

CoreFinOps is a multi-tenant SaaS with financial and migration data that can be commercially sensitive. Its defense model must separate user identity, tenant authorization, customer AWS data access and billing-provider trust.

Identity and tenant authorization

The target architecture uses Cognito for user sign-in. The API validates the authenticated subject, resolves membership/permissions server-side, and applies transaction-scoped tenant context. Tenant-owned PostgreSQL data is protected by FORCE RLS and tenant-safe relationships.

Customer AWS access

The customer deploys a read-only IAM role trusted with an ExternalId condition. CoreFinOps assumes that role for short-lived AWS reads. Role ARN/ExternalId material is handled through controlled secrets storage, not exposed in list responses or audit logs. No static customer IAM keys are required.

Billing and Marketplace trust

A hosted provider handles direct payments. AWS Marketplace seller APIs and lifecycle events use seller-side credentials. Neither trust context should be confused with an AWS cost-analysis account connection.

Customer controls

An authorized customer admin can disconnect a connection, review access and manage tenant data according to the deployed product policies. Disconnecting is not the same as deleting the AWS role; Marketplace cancellation is not an instruction to immediately destroy financial history.

Honest security claims

Do not assert SOC 2 certification, ISO certification, full regulatory compliance, penetration-test completion or production backup verification unless current evidence explicitly supports those statements. Product controls are not equivalent to third-party certification.