Database-per-tenant
Each tenant has a separate PostgreSQL database and role. This is a strong defence against application-layer cross-tenant mistakes; it is not protection from a fully compromised host.
Trust architecture
Say the control that exists — and the boundary it actually protects.
Benedam is sold to technical security teams. Our public claims are deliberately narrower than our ambitions and change only when a control is deployed, tested, and evidenced.
Deployed design
Application and tenant security
These statements describe implemented architecture, not certifications or future controls.
Row-level security
PostgreSQL RLS is applied inside the tenant database as defence in depth. Tenant identity is set with SET LOCAL inside a transaction so pooled connections cannot retain another caller’s context.
Per-host sessions
Cookies use the __Host- prefix and never Domain=.benedam.com. Tenant access tokens are bound to the host audience; cross-host transitions use a short-lived handoff code.
AI permission ceiling
ROSS has no database network access and no write tools. It forwards the caller’s token to read-only domain APIs, and tenant identity never comes from a model-supplied argument.
Operator validation
Automated scan results are drafts. Only an authorised BalticSec operator can validate and publish a finding to a client.
Engine isolation
The pilot engine uses a dedicated Redis stream identity and scoped callback token. It has no PostgreSQL route, no Docker socket, and no privileged container access.
Data and infrastructure
Current posture and explicit readiness gates
EU hosting is active. Some customer-readiness controls remain blockers and are not marketed as complete.
- EU-hosted application and control plane
- Cloudflare proxy with strict origin TLS
- Service memory and log limits
- Immutable application image deployment model
- Encrypted customer engine storage
- Observed offsite backup timers
- Scratch tenant and evidence restore drill
- Verified customer engine end-to-end run
Real customer scanning and evidence retention remain blocked until every gate is completed and recorded.
Disclosure
Found a security issue?
Please use our coordinated disclosure process. Do not test production customer workspaces or access data that is not yours.
Responsible disclosure policyStart with evidence
Turn the next security test into a continuous assurance programme.
Explore a read-only product tour, or tell us what you need to prove and we will scope it with you.