Security architecture: isolation, encryption and access

Tenant isolation (app and database)

LexCore is multi-tenant by design, and isolation is enforced twice. A deny-by-default query guard automatically scopes every tenant-owned and matter-scoped query to the requesting tenant. Database-level Row-Level Security backs it up, so even a coding mistake can't leak data across tenants. A startup check refuses to trust RLS if the database role could bypass it.

Encryption

Documents are encrypted at rest with AES-256-GCM. Production requires an encryption key, which can be sourced from a KMS. Traffic in transit uses TLS. Envelope encryption and key rotation are the documented next step.

Access control

• Authentication through an OpenID Connect identity provider (self-hosted Keycloak on the managed cloud), with a real tenant-membership check on every request. In production the guard refuses to boot without its identity provider configured, so it fails fast instead of silently allowing access.
• Authorisation through a roles guard on destructive and admin routes, plus step-up MFA on sensitive actions.
• Service-to-service auth between the internal services, with the provisioning credential bound to a tenant.
• Edge baseline. Rate limiting, security headers, request-id correlation, strict input validation, and a deny-by-default CORS allowlist in production.