Security & Compliance

Security and compliance as core design principles

1. Infrastructure Security

Google Cloud Platform (GCP) Serverless Architecture

• Fully Managed Services: AppEngine Standard, BigQuery, Datastore, Cloud Tasks - no servers to patch
• Auto-Scaling: Scale from 0 to 1000+ instances automatically based on traffic
• Single-Region Deployment: All Demeterics data and compute run in us-central1 (United States). We do not currently offer EU or APAC data residency.
• DDoS Protection: Google Cloud Load Balancer with built-in DDoS mitigation

2. Data Encryption

Encryption at Rest and in Transit

• TLS 1.3: All API traffic encrypted with TLS 1.3 (HTTPS-only)
• AES-256: BigQuery data encrypted at rest with AES-256
• Secure Cookies: Session cookies encrypted with AES-GCM using SHA-256-derived keys
• API Key Hashing: Demeterics API keys hashed with bcrypt (cost factor 12) before storage
• Provider Key Encryption: Third-party provider API keys (OpenAI, Groq, Anthropic, Google AI) encrypted with Google Cloud KMS using AES-256 hardware-backed encryption before storage
• In-Memory Caching: Decrypted provider keys cached in memory for 15 minutes with automatic expiration
• Zero Logging: Provider API keys never logged in plain text anywhere in the system

3. Authentication & Authorization

Multi-Layer Auth with Tenant Isolation

• Google OAuth2: Web UI login via Google OAuth2 with email verification
• Domain Allowlist: Restrict access to specific email domains or hosted domains
• API Key Authentication: Programmatic access via bcrypt-hashed API keys
• Rate Limiting: Configurable per API key (requests/minute). Unlimited by default; set a limit on any key from the dashboard.
• Tenant Isolation: Strict user_id filtering in all BigQuery queries

4. Secrets Management

Google Secret Manager & KMS for All Sensitive Values

• OAuth Secrets: Client ID/Secret stored in Secret Manager, never in code
• Session Secrets: Rotation-ready; 5-second timeout on Secret Manager calls
• API Key Pepper: Application-level secret for API key hashing
• Provider API Keys: Encrypted with Google Cloud KMS before storage, decrypted on-demand with audit logging
• KMS Key Versioning: Provider keys are encrypted under a Google Cloud KMS key. Key versions are managed in KMS, so the key can be rotated without re-encrypting stored data.
• Google-Managed Key Material: KMS keys use the SOFTWARE protection level (FIPS 140-2 Level 1). Key material never leaves Google Cloud KMS and is never exposed to Demeterics application code.
• No Hardcoded Secrets: All secrets loaded from environment, Secret Manager, or KMS-encrypted storage

5. Network Security

Defense-in-Depth Network Controls

• HTTPS-Only: Automatic HTTP → HTTPS redirect (301/308)
• HSTS Headers: Strict-Transport-Security with preload directive
• CSP Headers: Content-Security-Policy restricts script, style, frame and connect sources to an explicit allowlist; object-src and frame-ancestors are 'none'. Nonce infrastructure is in place, but 'unsafe-inline' is still permitted for scripts and styles pending migration of legacy inline handlers.
• X-Frame-Options: Clickjacking protection (DENY)
• CORS: Deny by default; wildcard only in development

6. Application Security

Secure Coding Practices & Input Validation

• Input Validation: All API inputs validated against schemas
• Parameterized Queries: BigQuery queries use parameter binding
• Output Encoding: HTML/JavaScript escaping in server-rendered templates
• No SQL Injection: Go type-safe queries prevent SQL injection
• Idempotency Keys: X-Request-ID prevents duplicate writes (24-hour cache)

7. Data Privacy & Retention

GDPR, CCPA, and Privacy-by-Design

• Data Minimization: Only capture question/answer pairs and metadata
• Right to Access: Export API returns all data for a user
• Right to Deletion: DELETE /api/v1/data triggers GDPR-compliant deletion
• Data Portability: Export to CSV/JSON formats

Configurable Data Retention (per API key)

• Zero-Day Retention (ZDR): Prompt/response content is never stored - only content hashes (SHA-256 payload digests plus per-message MD5 digests), token counts, costs, and metadata are retained. Maximum privacy for sensitive data.
• 30 days: Content stored for 30 days, then permanently deleted by automated cron job
• 90 days (default): Content stored for 90 days, then permanently deleted
• 1 year (365 days): Content stored for 1 year, then permanently deleted

What's Always Preserved (for billing & analytics)

• Content hashes — SHA-256 payload digests and per-message MD5 digests (for deduplication verification)
• Token counts (prompt, completion, total)
• Cost data (LLM cost, service fee, total)
• Timestamps, model names, provider, latency metrics
• Transaction IDs (for audit trail)

API Key Expiration (separate from data retention)

• API keys can be configured to expire after 30 days, 90 days, 1 year, or never
• Expired keys return 401 Unauthorized - rotation recommended every 90 days
• Email notifications sent 14 days before key expiration

8. Audit & Logging

Complete Audit Trail for Compliance

• API Key Operations: All create/update/delete operations logged
• Data Access Logs: BigQuery audit logs track all data access
• Request IDs: ULID-based request IDs for end-to-end tracing
• Structured Logging: slog-based structured logs (no PII logged)
• Content Hashing: SHA-256 payload digests and per-message MD5 digests for deduplication and verification

9. Incident Response

Prepared for Security Incidents

• Error Alerting: Structured logs and error reporting via Google Cloud Logging. Automated uptime monitoring and a public status page are on our roadmap.
• Incident Response Plan: Documented process for security incidents
• Breach Notification: 72-hour notification for GDPR compliance
• Rollback Capability: AppEngine version rollback in < 5 minutes

10. Compliance Certifications

Current Status & Roadmap

Standard	Status	Notes
GDPR	Ready	Data export, deletion, portability built-in
CCPA	Ready	California consumer rights supported
SOC 2 Type II	Not certified	No third-party auditor engaged. We maintain the control set a SOC 2 audit examines and assess ourselves against it — see our security package.

11. Third-Party Security

Supply Chain Security

• Minimal Dependencies: Go standard library preferred; minimal external packages
• Dependency Scanning: Dependabot alerts enabled on GitHub
• GCP Provenance: All services provided by Google Cloud Platform

12. Vulnerability Disclosure

Responsible Disclosure Policy

If you discover a security vulnerability, please report it to:

Email: security@demeterics.com
Machine-readable policy: /.well-known/security.txt
Response Time: We acknowledge all reports within 2 business days
Disclosure Timeline: 90 days from report to public disclosure

Coordinated Disclosure: We operate a coordinated vulnerability disclosure program with recognition for reporters. We do not run a paid bug bounty.

13. Security Updates

A public status page with uptime, incident history and planned maintenance is on our roadmap. Until it ships, service notices are sent by email to affected accounts with information about security updates, incidents, and planned maintenance.

14. Questions?

For security questions or to request our security whitepaper, contact:
Email: support@demeterics.com
Response Time: 2 business days for all inquiries