RAVEN is designed to handle sensitive consumer financial data for regulated institutions. Security is built into every layer of the platform, not added as an afterthought.
2. Encryption
2.1 Encryption at Rest
Algorithm: AES-256-GCM
Key management: AWS KMS with envelope encryption
Per-user keys: Each user's data is encrypted with a unique Data Encryption Key (DEK). The DEK is itself encrypted by a KMS-managed master key.
Field-level encryption: Every individual field in every module is encrypted independently. Compromising one field does not expose others.
Crypto-shredding: Deleting a user's DEK renders all their data permanently unrecoverable, even from database backups.
2.2 Encryption in Transit
All API endpoints served over TLS 1.2+
All outbound connections to third-party providers use TLS
Provider credentials are stored as encrypted environment variables, never in code
3. Authentication and Access Control
3.1 API Authentication
API keys use the format frodo_live_<32 hex> (production) or frodo_test_<32 hex> (sandbox)
Keys are stored as SHA-256 hashes — the raw key is shown once at creation and never stored
Key lookup uses an 8-character prefix via a DynamoDB GSI for efficient matching without exposing the full hash
3.2 Multi-Tenant Isolation
Each tenant (customer) is isolated by tenant ID at the data layer
Tenant-user links ensure a tenant can only access users they have created or been linked to
Permission controls restrict which modules each tenant can access
Sandbox and production environments are separated at the API key level
3.3 Consumer Verification
Three verification tiers: OTP (email/phone), Enhanced OTP (both channels), and Identity (PII match)
OTP codes are 6-digit cryptographically random, stored as SHA-256 hashes, expire in 10 minutes, and lock out after 3 failed attempts
Sessions use sliding 15-minute windows with a 1-hour absolute maximum lifetime
4. Audit Trail
Every data change is recorded as an immutable event with: who (source/actor), what (field changes with before/after values), when (timestamp), and confidence score
Events are append-only — they cannot be modified or deleted except through user deletion
API access logs record every tenant request with request ID, tenant ID, and timestamp
Consent records store SHA-256 hashes of the exact consent text shown to the user
5. Third-Party Provider Security
Provider credentials are read from environment variables at runtime, never hardcoded
Per-user OAuth tokens (e.g., Plaid access tokens) are encrypted with the user's DEK in the same envelope encryption scheme as module data
The HTTP client automatically classifies and handles provider errors (auth failures, rate limits, timeouts) without leaking credentials in logs
Provider health is tracked in-memory with a 5-minute sliding window; degraded providers do not block other enrichment sources
6. Infrastructure
Database: Amazon DynamoDB with encryption at rest enabled
Key management: AWS KMS with automatic key rotation
Runtime: Bun on AWS (containerized)
Logging: Structured JSON logs via Pino (no PII in logs)
7. Vulnerability Reporting
If you discover a security vulnerability, please report it to security@reportraven.tech. We will acknowledge receipt within 24 hours and provide a timeline for resolution.