--- title: "Security · Hyperscale" canonical: https://hyperscale0.ai/security --- # Security belongs in the system design. The verified controls around identity, tenant isolation, agent access, contracts, receipts, ledger truth, and provider boundaries. The security page explains database isolation between companies, scoped keys, password-based platform access, safe repeated requests, immutable receipts, and the separate records for business data and money balances. These controls protect sandbox Products today. They do not claim that any tenant is live. Hyperscale is the foundation for what gets built next. A founder describes a company in one sentence, and Hyperscale builds its foundation on a licensed bank partner. The founder works in the portal with the Architect. Developers can use the CLI, Product API, generated SDKs, or MCP. Every state change records who asked, what ran, and the result in a receipt. Hyperscale is not a bank and never holds a tenant's money under its own name. Every Product starts in a sandbox with test identities, provider simulators, and play money. No tenant is live today. The current systems connect to no real bank infrastructure. Moving a future Product to live use requires a separate Product Activation review, identity checks, provider approval, and billing readiness. The bank partner would perform every regulated money movement. Last updated 24 September 2026 ## Regulatory alignment Hyperscale is a technology operating system, not a regulated bank. A future Product would connect to regulated banks or providers that hold funds and execute external money movement. No such connection exists today. Hyperscale does not hold customer funds, issue bank accounts, or execute bank settlement itself. The [privacy policy](/privacy) describes current data handling. It does not turn this test system into a certified or regulated service. ## Compliance posture Hyperscale claims no SOC, ISO, PCI DSS, FIPS module, or regulatory certification. This page names controls that exist in the tree and in the two test environments. Current controls include forced row-level security, least-privilege database roles, encrypted secrets, password-based platform operator access, immutable receipts, and a deterministic release gate. Certification status will only appear here after an independent assessment grants it. ## The edge Both public test origins reach their local guest services through Cloudflare tunnels. Guest services bind to loopback. The tunnel process makes the outbound connection, so the services do not expose a guest listener to the public network. The API also applies route and identity rate limits. The deployment process verifies the exact committed artifact before a release. These are test environments, not a production boundary. ## Architecture and data security Isolation is enforced by the database, not just the application. Tenant tables run PostgreSQL row-level security in FORCE mode with per-tenant policies. Five least-privilege database roles serve the platform; none is a superuser and none can bypass row-level security. On top of that, every application query is independently tenant-scoped, so isolation holds if an application query omits its tenant filter. Sandbox and the inactive live environment are separated at the row and ledger level. Secrets at rest, including webhook signing secrets, are protected with AES-256-GCM envelope encryption. Envelopes are versioned, keys rotate, and data is lazily resealed to the current key on read. Hyperscale uses AES-256-GCM for envelope encryption and SHA-256 for hashes and key fingerprints. It has no FIPS 140-3 validated module. ## The money core The ledger database owns double-entry money truth in the test environments. Ledger accounts separate Product, currency, and environment. Overdraft protection is a ledger constraint. Pending transfers use reserve, post, and void transitions. PostgreSQL stores workflow and contract state, not balances. Deterministic transfer IDs make a replay collide with the original ledger entry. Mutations use idempotency keys. Contract policy adds explicit confirmation to operations that need it. Terminal receipts cannot be rewritten. No entry represents real money today. ## Access and authentication Passwords are hashed with argon2id, the winner of the Password Hashing Competition. Sessions are server-minted cookies marked httpOnly, Secure, and SameSite=Strict; the session token is never exposed to JavaScript. Cross-site request forgery is blocked with a double-submit token compared in constant time, and the API host exposes no CORS surface. Users and platform operators sign in with email and password in every environment. API keys are shown once at creation; the database stores only a SHA-256 hash. Keys are permission-scoped per Product, and revocation is idempotent. Role changes revoke active sessions. Every API route carries fair-use rate limiting, with dedicated abuse guards on identity endpoints. ## Auditability State-changing operations write immutable receipts, audit events, and usage records. Sensitive audit bodies are redacted on read. Product-scoped timelines record what happened, when it happened, and which principal requested it. ## Software supply chain The release gate runs no security scanners before live use. An operator runs one scan command that checks three inputs: CVE scanning of the full dependency lockfile · osv-scanner Secret scanning of the git history · gitleaks License compliance · REUSE and SPDX The command fails on a known dependency vulnerability, a leaked secret, a license policy failure, or a missing scanner. A scan that matches zero packages fails. Dependencies are exact-pinned. Hyperscale does not generate an SBOM today. Release artifacts are content-addressed. Deployment recomputes the digest and verifies its provenance before either test environment serves it. ## Engineering rigor We treat correctness as a security property. The repository uses property-based and stateful testing over the real stack, an in-memory Postgres test tier, end-to-end browser tests, and golden-file contract suites. Typed contracts generate the SDKs, and freshness checks compare every owned output byte. Frozen catalog entries cannot change meaning in place. The stack is deliberately small: TypeScript on Bun, PostgreSQL 18, TigerBeetle, Hono, React 19, with Cloudflare at the edge. ## Vendor due diligence This page is the current public control summary. The [privacy policy](/privacy) documents data handling. The repository documents architecture, threat boundaries, release checks, and current limitations. Hyperscale has no live customer diligence pack or certification report. ## Responsible disclosure Report a suspected vulnerability through this repository's private GitHub security advisory. Do not open a public issue. The project makes no public response-time or safe-harbor promise today. ## Site index [Home](/) · [Docs](/docs) · [Legal](/legal) · [Service status](https://status.hyperscale0.ai) · [Sign in](/sign-in) ## Agent resources [HTTP API](/docs/api.md) · [Product runtime](/docs/runtime.md) · [MCP discovery](/.well-known/mcp.json) · [OpenAPI](/openapi.json) · [Sitemap](/sitemap.xml)