Architecture and isolation
Moonbrush runs every client on shared infrastructure with isolation enforced at three layers: the application, the warehouse and the database. Each layer is built to fail safe, returning nothing when it is unsure whose data a request belongs to.
Application layer
Section titled “Application layer”- Every query is scoped. Every query that touches organization data is filtered to the caller’s organization. When the scope cannot be determined, the query returns nothing.
- New data must declare its tenancy. A build-time test fails if a new kind of data is added without a decision about which organization owns it.
- Two-organization test on every build. Every build runs a test with two organizations and fails if either can see the other’s data.
Warehouse layer
Section titled “Warehouse layer”- One identity per organization. Each organization has its own service identity in the data warehouse and its own schema of views over its data.
- Denied by permissions, not by query clauses. Cross-organization reads are blocked by the warehouse’s own permission system, so a query that forgot a filter still cannot read another organization’s data.
- No shared fallback. An organization that has not been provisioned is refused. It is never given a shared credential.
- Credentials are encrypted and rotated. Per-organization warehouse credentials are encrypted with AES-256-GCM and rotated automatically.
Database layer
Section titled “Database layer”A database-level backstop enforces organization boundaries underneath the application, so the application is not the only line of defense.
Models and client data
Section titled “Models and client data”- A client’s Outcome models are stored with that client’s organization.
- No model is trained across clients, and no client’s data trains a model another client uses.
- An organization can be flagged so that no model trains on its data at all.
See Outcome models.
Encryption
Section titled “Encryption”- Data at rest is encrypted with AES-256.
- Data in transit uses TLS 1.2 or higher.
The security program
Section titled “The security program”Moonbrush runs a written security program mapped to the NIST Cybersecurity Framework 2.0, with continuous control monitoring. A SOC 2 Type I report is available under NDA, and a SOC 2 Type II examination is underway. See the security overview.