Security Overview

1. Architecture at a Glance

SimpleSecurity is built entirely on serverless AWS services. There are no long-lived servers to provision, patch, or manage — compute runs only when a request is made.

Security is governed by the AWS shared-responsibility model: AWS is responsible for the security of the cloud (physical facilities, host infrastructure, virtualization layer, and patching of the underlying managed-service runtime). SimpleSecurity is responsible for security in the cloud — application code, IAM permission scoping, data protection, and service configuration.

2. Data Residency

All customer data at rest and all application compute run exclusively in AWS eu-north-1 (Stockholm, Sweden). There is no replication of customer data outside the EU/EEA.

One transparent exception: the configuration object for the AWS WAF web-ACL that protects the CloudFront distribution is stored in AWS us-east-1. This is an AWS platform requirement for WAFs scoped to CloudFront — it is rule configuration only, and no customer data is stored there. CloudFront itself is a global content-delivery network that serves the static frontend from edge locations worldwide, as is standard for any CDN.

3. Encryption

In transit

All traffic is HTTPS-only. CloudFront redirects HTTP requests to HTTPS, and the API is served exclusively over HTTPS.

At rest

All data stores use AWS-managed encryption: DynamoDB tables use server-side encryption, and S3 buckets use AES-256 encryption.

Payment data

Payment card data is handled entirely by Stripe and never touches SimpleSecurity systems. Stripe API keys are stored in AWS Secrets Manager.

4. Identity & Access Management

• Authentication is handled by AWS Cognito.
• Password policy: minimum 12 characters, including upper- and lowercase letters, numbers, and symbols.
• Multi-factor authentication (TOTP) is available to all users; organization admins can enforce MFA for the entire organization.
• Cognito advanced security is enforced — adaptive risk detection and compromised-credential checks run on every sign-in attempt.
• Every data-plane API route requires a validated Cognito JWT, checked by an API Gateway Cognito authorizer.
• Role-based access control with read/write/delete/execute permission tiers per service, applied via group-based permissions with per-user overrides.
• Account recovery is only possible via a verified email address.

5. Tenant Isolation

Every customer's data is partitioned by tenant_id, which is the DynamoDB partition key on every table. Every query is scoped to the authenticated tenant. Requests without a valid tenant fail closed — they are rejected with a 401 response rather than falling back to a default or shared dataset.

6. Network & Edge Protection

• AWS WAF sits in front of the application with AWS managed rule sets: IP reputation, OWASP-aligned common attack patterns, and known bad inputs — plus rate limiting of 2,000 requests per IP per 5 minutes.
• API Gateway throttling: a global limit of 100 requests/second (burst 20), with the login and registration endpoints tightened further to 5 requests/second (burst 2).

7. Monitoring, Logging & Audit

• AWS CloudTrail: full, multi-region audit logging of infrastructure and administrative API actions, with log-file integrity validation. Audit logs are retained 90 days in a dedicated encrypted bucket.
• AWS CloudWatch: application logs retained 30 days.
• AWS X-Ray: distributed tracing on the API.
• CloudWatch alarms (Lambda errors, API 5xx responses, dead-letter queue depth, DynamoDB errors) notify the operations contact via SNS.
• AWS Budgets provides a cost-anomaly guard.

8. Resilience & Backup

• DynamoDB point-in-time recovery (PITR) is enabled on all tables, providing continuous backup and restore to any second within the last 35 days.
• DynamoDB, Lambda, and S3 are multi-AZ regional services by default.
• Background jobs use dead-letter queues with retry.
• Cognito user pool deletion protection is active.

9. Data Lifecycle & Customer Control

Monitoring history, scan results, and notifications auto-expire via DynamoDB TTL.

Under GDPR Art. 17, organization admins can permanently delete the entire organization — all users, assets, monitors, incidents, policies (including uploaded documents), vendor records, and settings — self-service from the dashboard ("Danger Zone" in User Management → Security), with typed confirmation. Deletion is also honored on written request to security@simplesecurity.se within 30 days.

10. Vendor Security

Infrastructure hosting runs on AWS under AWS's Data Processing Addendum (DPA). Payment processing is handled by Stripe, a PCI-DSS compliant payment processor. Stripe acts as an independent controller for card data. See the full list of sub-processors in Sub-Processors.

11. Responsible Disclosure

We welcome responsible disclosure of security issues. Report findings via /.well-known/security.txt or by emailing security@simplesecurity.se.

12. Compliance Alignment

SimpleSecurity's security program is aligned with ISO 27001 principles and maps controls to ISO 27001, SOC 2, NIS2 and MSBFS 2020:6-8.

A signable Data Processing Agreement, our Technical and Organisational Measures (TOMs), and our sub-processor list are available on request and linked here: Data Processing Agreement, Technical and Organisational Measures, Sub-Processors, Data Retention, and Incident Response & Breach Notification.