Security architecture & roadmap

Designed for
enterprise IT.

This page describes the security architecture ChainVision is being built around, and the roadmap for the certifications and audits that mining IT teams will ask for. ChainVision is pre-pilot. Specific certifications and audits are part of our funded commercialisation plan and are not currently in place. Please read this page as design principles and forward roadmap, not current state.

This security roadmap reflects the design principles ChainVision is being built around. Specific certifications and audits are part of our funded commercialisation plan and are not currently in place. Detailed roadmap available to qualified prospects under NDA.

Data isolation

Tenant isolation is designed to be enforced at the database engine, not just in application code. The intent is that a query for one organisation cannot return another organisation's rows even if an application endpoint is misconfigured.

Identity & access

Designed to support enterprise SSO (SAML 2.0 / OIDC) for integration with Microsoft Entra ID, Okta, or PingFederate, alongside named-user licensing, corporate email domain enforcement, and MFA mandatory for admin accounts. Roadmap item.

Deployment flexibility

Two deployment modes are planned: cloud SaaS in Australian region, and private cloud inside the customer's own AWS or Azure tenant. In private cloud mode, the design intent is that operational data stays inside customer infrastructure.

Encryption

Designed for TLS 1.3 in transit with no plaintext fallback, AES-256 at rest, and managed secret storage with no credentials committed to source control.

Immutable audit log

Designed so that every data access event (read, write, delete) is logged with user, source IP, timestamp, and resource accessed, with database-level rules preventing modification of audit rows. Roadmap item for first-pilot deployment.

IP protection

The deployment design protects the underlying methodology against extraction from on-premise containers, with revocable distribution credentials and a source-code-escrow option for enterprise customers as a roadmap item.

What lives where

In the planned private cloud deployment, operational data stays inside customer infrastructure. The simulation engine, where the proprietary methodology lives, remains on Copula Labs servers and is accessed via encrypted API. Diagram below reflects design intent, not a deployed system.

Private cloud deployment architecture · planned
Browser (User)
React App
── TLS 1.3 ──▶
Your Infrastructure (AWS / Azure)
Frontend (S3 / Blob)
API Gateway
Auth Service
PostgreSQL (RDS)
Redis (ElastiCache)
Audit Logs
Encrypted API call
(parameters only, no raw data)
Copula Labs Cloud (Sydney — ap-southeast-2)
Simulation Engine (Cython binary)
Blend Optimiser (SLSQP)
AI Insights (Claude API)
License Server
Your infrastructure · your data stays here (design intent)
Copula Labs servers · computation and methodology only (design intent)

Four layers. No gaps.

The design intent for tenant isolation is to enforce it at four independent layers simultaneously, so that the failure of any single layer does not expose another tenant's data. Each layer below is a design principle, intended for first-pilot deployment.

Layer 1 · Database
Row-level isolation
Every table is designed to carry an organisation identifier with database-engine policies that filter every query before the application layer sees any rows. The intent is that a misconfigured endpoint cannot return another organisation's data. Verification of this property in CI is a design requirement.
Layer 2 · API
Signed-token authentication on every request
Every API request is designed to carry a signed authentication token encoding organisation and role. The backend is intended to validate the signature on every request, rejecting forged or expired tokens before any database query runs.
Layer 3 · Storage
Per-organisation file isolation
Uploaded files are intended to be stored in per-organisation storage with signed URL access checked against the authenticated organisation. A valid token for one organisation should not be able to construct a URL to retrieve another organisation's files.
Layer 4 · Sessions
Concurrent session enforcement
Each named user account is limited to one active session at a time (Enterprise). A login on a second device invalidates the first session. Device fingerprinting flags anomalous logins (different browser, OS, or location) in the admin dashboard — providing early warning of credential sharing without blocking legitimate access.

What the IT security
team will ask for

The list below is the security control set ChainVision is being designed to support for first-pilot deployment. None of the controls below are currently in production. Each is a roadmap commitment, not a current capability.

Access & Identity
  • plan
    SAML 2.0 / OIDC SSO
    Designed to integrate with Microsoft Entra ID, Okta, and PingFederate so that users log in with existing corporate credentials. Enterprise tier. Roadmap.
  • plan
    Corporate email domain enforcement
    Org admin will allow-list email domains (e.g. @yourcompany.com) so that only users with approved domains can join the organisation. Roadmap.
  • plan
    MFA mandatory for admins
    Multi-factor authentication will be mandatory for all admin-role accounts across all tiers. Roadmap.
  • plan
    IP allowlisting
    Designed to restrict access to defined IP ranges or VPN, so that connections from outside allowed ranges are rejected regardless of credential validity. Enterprise tier. Roadmap.
  • plan
    Named-user licensing
    Licenses will be tied to specific named users, with an admin dashboard surfacing last login, last source IP, session status, and device type for every seat. Roadmap.
Data & Infrastructure
  • plan
    TLS 1.3 in transit, AES-256 at rest
    Designed so that all connections are enforced over TLS 1.3 with no plaintext fallback, and data at rest is encrypted with AES-256. Roadmap.
  • plan
    Australian data residency
    Cloud SaaS will be hosted in an Australian region. Private cloud deployment in the customer's own region of choice is part of the deployment design. Roadmap.
  • plan
    Automated dependency scanning
    Build pipeline will scan dependencies on every push and flag vulnerable packages before release. Roadmap.
  • plan
    Rate limiting on sensitive endpoints
    Simulation and upload endpoints will be rate-limited, with configurable per-organisation limits at the Enterprise tier. Roadmap.
  • plan
    No secrets in client bundles
    Build pipeline will verify that no service keys, signing secrets, or database URLs appear in the compiled frontend bundle, as a regression check on every release. Roadmap.

The questions your IT team will ask

This is the list we expect from an enterprise IT security review. The status column reflects honest current state. ChainVision is pre-pilot; certifications and audits are part of our funded commercialisation plan and have not yet commenced.

Question Status Notes
SOC 2 Type IIPlanned post-pilot fundingIndependent audit yet to commence. Engagement is part of the post-pilot commercialisation plan.
ISO 27001Planned subsequent to SOC 2Formal certification programme planned after SOC 2 readiness is established.
Penetration testPlanned pre-first-pilotExternal penetration test planned prior to first paid pilot deployment. Has not yet been performed.
SAML SSO (Entra ID, Okta)Designed for · roadmapArchitecture supports SAML 2.0 / OIDC integration. Available at Enterprise tier from first pilot.
Cross-tenant isolationDesign principleDatabase-engine row-level isolation is a design requirement. CI verification of the property is on the roadmap.
Service key rotation runbookRoadmapZero-downtime rotation procedure to be documented and rehearsed before first pilot.
Data residency in AustraliaDesigned forCloud SaaS planned for Australian region. Private cloud deployment in customer-chosen region is part of the deployment design.
Private cloud deploymentDesigned for · roadmapContainerised deployment in customer's own AWS or Azure tenant is a planned deployment mode at Enterprise tier.
Source code escrowPlanned for Enterprise tierSource code escrow with a neutral third party is a roadmap item for Enterprise customers.
No vendor lock-in on dataDesign principleStandard-format export of simulation inputs, results, and configurations is a design requirement.
GDPR / Australian Privacy ActDesign principleData Processing Addendum to be made available. Personal data is intended to be limited to user account information.
Incident response SLADesigned for Enterprise tierDocumented incident response procedure with response and resolution targets is a roadmap item.
Backup and recoveryRoadmapAutomated backups, retention, and tested restore procedures are part of the pre-pilot operational checklist.

Want the
full security roadmap?

The detailed security and architecture roadmap, including the pre-pilot operational checklist and the certifications timeline, is available to qualified prospects under NDA.

This page contains commercially sensitive information about ChainVision and is provided to NDA-signed parties under section 3.7.4 of the Industry Growth Program Information Guide and applicable confidentiality agreements. Please do not redistribute.