Phase 4 · Node Layer 22 · Systems & Proof Close

The posture behind the node.
Encrypted. Audited. Least-privilege. 24/7.

The Tennant node maintains a security posture designed for SOC 2 Type II controls, ISO 27001 alignment, encryption in transit and at rest, least-privilege access, and full audit logging. Authentication uses OAuth 2.0 with optional mTLS. Keys rotate every 90 days. Incident response runs 24/7 with defined severity tiers. Every event is written to an append-only audit log that is externally consumable. This is the page a CISO forwards to a peer.

SOC 2 controls TLS 1.3 + AES-256 Least-privilege access OAuth 2.0 + mTLS Append-only audit
UPT
Security Uptime
99.97%
Rolling 30-day
ENC
Encryption
100%
Transit + at rest
MTD
MTTD
< 2 min
Mean time to detect
AUD
Audit Retention
7 years
Append-only log
The Posture

Four dimensions. Every one implemented.

Security is not a single control — it is four dimensions operating together. Click any card to see its implementation detail, cadence, and evidence.

Security Posture · Active
Auth Encryption Access Response
AU
Dimension 01

Authentication

OAuth 2.0 with optional mTLS for service-to-service calls. SAP connections use SAP IAS compatibility. Every credential rotates on a defined schedule.

Protocol OAuth 2.0
Credential Age ≤ 90 days
EN
Dimension 02

Encryption

Data encrypted in transit (TLS 1.3) and at rest (AES-256). Keys managed through a dedicated KMS with rotation every 90 days. No unencrypted channels exist.

In Transit TLS 1.3
At Rest AES-256
AC
Dimension 03

Access Control

Least-privilege model. Every principal has only the minimum permissions required for its role. No standing admin access. Every elevation is logged with full context.

Model Least-privilege
Admin Access Time-bound
IR
Dimension 04

Incident Response

24/7 incident response with defined severity tiers, defined escalation paths, and defined communication cadence. Post-incident reports include full trace and audit data.

Coverage 24/7
MTTD < 2 min
Dimension 01 · Authentication

OAuth 2.0 with optional mTLS.

Every principal authenticates via OAuth 2.0 with short-lived tokens. Service-to-service calls can optionally use mTLS for mutual authentication. SAP connections use SAP IAS compatibility so existing SAP identity infrastructure extends to the layer without re-provisioning. Every credential rotates on a defined schedule — no credential exceeds 90 days of age.

Implementation
OAuth 2.0 + mTLS optional
Cadence
Credentials rotate ≤ 90 days
Evidence
Token log + rotation audit
The Frameworks

Four frameworks. Every one supported.

The node is designed against four industry-standard frameworks. Full compliance evidence — controls, tests, and results — is available at activation under NDA. Click any framework for detail.

SOC 2

SOC 2 Type II

Trust Services Criteria · controls aligned

ISO 27k

ISO 27001

ISMS practices · aligned

GDPR

Data subject rights supported

CCPA

CCPA / CPRA

California privacy compliance

Live Stream

Security events · live

The security stream shows every auth, crypto, access, audit, and rotation event in real time. Every event is written to the append-only audit log. Nothing is deleted.

Security Event Stream · Live 12 events
08:00:01 AUTH OAuth 2.0 token issued · principal svc-reconcile · TTL 60m
08:00:03 CRYPTO TLS 1.3 handshake · SAP Adapter · cipher suite verified
08:00:04 ACCESS Read /layer/v1/orders/PM-847291 · principal authorized
08:14:11 AUDIT Event written to append-only log · hash chain verified
08:22:41 AUTH mTLS mutual auth · svc-adapter ↔ svc-sap · cert valid
09:00:00 ROTATE Scheduled key rotation · session-keys-20261012 · zero downtime
09:14:22 CRYPTO At-rest encryption · AES-256 · block verified
09:31:11 ACCESS Time-bound elevation approved · principal ops-engineering · 15m window
10:00:00 AUDIT Audit log integrity check · hash chain unbroken
10:15:44 AUTH Failed auth attempt rate-limited · 3 attempts · IP blocked
10:44:31 ACCESS Elevation expired · principal ops-engineering · access revoked
11:22:05 AUDIT Full audit write confirmed · chain preserved · 90-day retention extended to 7yr
Metrics

Security metrics. Continuous.

Four primary security metrics: mean time to detect, mean time to respond, failed auth attempts, and audit retention. All measured continuously. Click any tile for detail.

MTTD
< 2 min
Mean time to detect
MTTR
< 15 min
Mean time to respond
Failed Auth / Day
0.4
Rate-limited per principal
Audit Retention
7 years
Append-only · hash-chained
Questions

Security, answered.

The node maintains SOC 2 controls, ISO 27001-aligned practices, encryption in transit and at rest, least-privilege access control, and full audit logging. Every system access is logged with trace ID and request context. Every key rotates every 90 days. Every incident is tracked with a defined response cadence.

Authentication uses OAuth 2.0 with optional mTLS for service-to-service calls. SAP connections use SAP IAS compatibility. Every credential is rotated on a defined schedule — no credential exceeds 90 days of age. Failed auth attempts are rate-limited and logged.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Keys are managed through a dedicated KMS with rotation every 90 days. No unencrypted channels exist. Every encryption operation is logged.

The node is designed to SOC 2 Type II controls, aligns with ISO 27001 practices, and supports GDPR and CCPA data handling requirements. Compliance evidence — controls, tests, and results — is available at activation under NDA.

A 24/7 incident response process with defined severity tiers, defined escalation paths, and defined communication cadence. Post-incident reports include full trace and audit data. Mean time to detect is under 2 minutes. Mean time to respond is under 15 minutes.

Phase 4 closes.

Systems delivered. Proof published. Security posture documented. Phase 5 remains: Trust & Close — FAQ, ROI, contact, home.

See the full node Activate the node