Skip to content

Commit 9a3a5f6

Browse files
Cyrah2RCyrah2R
committed
docs(cloud): add PUBLIC_EVIDENCE_INDEX.md — closes #13
Single-entry-point document for CISO/auditor due diligence. 9 sections: supply chain, IAM, cryptography, data governance, infrastructure hardening, observability, pentests, public artifacts, NDA data room. Links all existing lumatrace-cloud governance docs. Add link in TRUST_CENTER.md. docs(cloud): document JPEG output contract for /protect — closes #14 openapi.yaml /api/v1/photos/protect: explicit note that output is always image/jpeg regardless of input format. Prevents integration friction for clients uploading PNG/WEBP assets.
1 parent b2e5403 commit 9a3a5f6

File tree

3 files changed

+178
-6
lines changed

3 files changed

+178
-6
lines changed

‎PUBLIC_EVIDENCE_INDEX.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# LumaTrace — Public Evidence Index
2+
3+
**Version:** 1.0
4+
**Classification:** Public
5+
**Audience:** CISO, InfoSec Auditors, Procurement Teams, Legal Counsel
6+
**Maintained by:** LumaTrace Security & Engineering Team
7+
**Contact:** enterprise@lumatrace.es
8+
9+
> This document is the single entry point for enterprise due diligence.
10+
> It enumerates all publicly available security controls, compliance artifacts,
11+
> and engineering evidence. Sensitive materials (full pentest reports, internal
12+
> control matrices, SBOM archives) are available under a signed NDA.
13+
14+
---
15+
16+
## 1. Supply Chain Security
17+
18+
| Control | Evidence | Status |
19+
|:---------------------------------------|:--------------------------------------------------------|:------------|
20+
| Automated SAST (CodeQL) | GitHub Actions CI — every commit | ✅ Active |
21+
| Dependency vulnerability scan (Trivy) | CI Pipeline — blocks on CRITICAL CVEs | ✅ Active |
22+
| Software Bill of Materials (CycloneDX) | `bom.json` generated per release | ✅ Active |
23+
| License compliance check | No GPL/AGPL in proprietary modules | ✅ Verified |
24+
| Container supply chain | c2patool binary hash validated at startup (`LT-SEC-05`) | ✅ Active |
25+
| Secret scanning | Trivy filesystem scan — no hardcoded secrets | ✅ Active |
26+
27+
---
28+
29+
## 2. Identity, Authentication & Multi-Tenant Isolation
30+
31+
| Control | Evidence | Status |
32+
|:------------------------------------|:----------------------------------------------------------------------------------|:---------|
33+
| Multi-tenant login isolation | `tenantId + username` composite lookup — prevents cross-tenant identity collision | ✅ Active |
34+
| JWT Zero-Trust claims | Strict `iss`, `aud`, `exp`, `nbf`, `jti` validation on every request | ✅ Active |
35+
| Active session revocation | Redis-backed JWT blocklist (`LT-SEC-02`) | ✅ Active |
36+
| Tenant data isolation | `findByIdAndTenantId` — DB-level scoping on all asset queries | ✅ Active |
37+
| RBAC enforcement | Spring `@EnableMethodSecurity` — `ROLE_USER / ROLE_AUDITOR / ROLE_ADMIN` | ✅ Active |
38+
| Rate limiting (Fail-Closed) | Redis distributed token-bucket — fails closed if Redis unavailable | ✅ Active |
39+
| X-Forwarded-For spoofing protection | CIDR-trusted proxy whitelist in `LoginRateLimitFilter` | ✅ Active |
40+
41+
Reference: [Architecture & Trust Boundaries](./ARCHITECTURE.md) · [SOC2 Control Mapping](./SOC2_MAPPING.md)
42+
43+
---
44+
45+
## 3. Cryptographic Integrity
46+
47+
| Control | Evidence | Status |
48+
|:----------------------------|:-----------------------------------------------------------------------------|:---------|
49+
| Watermark seed derivation | RFC 5869 strict HKDF (HmacSHA256) with tenant + user + asset + nonce + keyId | ✅ Active |
50+
| Key rotation support | `keyId` parameter in HKDF info string — verifiable across key generations | ✅ Active |
51+
| C2PA hard-binding | JUMBF manifest signed with X.509 v3 PKI (RSA ps384) | ✅ Active |
52+
| Time-stamping authority | DigiCert TSA over **HTTPS** — temporal non-repudiation | ✅ Active |
53+
| PKI fail-closed | Self-signed certificates prohibited in `prod` profile | ✅ Active |
54+
| CSPRNG | AES-CTR deterministic PRNG (replaces `java.util.Random`) | ✅ Active |
55+
| Payload integrity | SHA-256 content hash verified before processing | ✅ Active |
56+
| Certificate rotation policy | 90-day C2PA signing key rotation | ✅ Active |
57+
58+
Reference: [Security Whitepaper](./SECURITY_WHITEPAPER.md) · [Security Assurance](./ASSURANCE.md)
59+
60+
---
61+
62+
## 4. Data Governance & Zero-Retention
63+
64+
| Control | Evidence | Status |
65+
|:----------------------------|:--------------------------------------------------------------------|:---------|
66+
| Zero image retention | Processing on ephemeral `tmpfs` RAM-disk (`LT-SEC-04`) | ✅ Active |
67+
| No persistent binary assets | Only cryptographic metadata (hash, nonce, tenantId) persisted in DB | ✅ Active |
68+
| GDPR compliance | Erasure-by-design architecture — no PII in image pipeline | ✅ Active |
69+
| Data residency | Processing buffers: Spain/EU | ✅ Active |
70+
71+
Reference: [Data Privacy Policy](./DATA_PRIVACY.md) · [Subprocessors](./SUBPROCESSORS.md)
72+
73+
---
74+
75+
## 5. Infrastructure Hardening
76+
77+
| Control | Evidence | Status |
78+
|:-------------------------------|:--------------------------------------------------------------|:---------|
79+
| Read-only container filesystem | `read_only: true` in docker-compose (`LT-SEC-05`) | ✅ Active |
80+
| Capability dropping | `cap_drop: ALL` + `no-new-privileges:true` | ✅ Active |
81+
| Non-root execution | Dockerfile runs as user `luma` | ✅ Active |
82+
| PostgreSQL SSL | `sslmode=require` on JDBC connection | ✅ Active |
83+
| Redis AUTH | `requirepass` enforced — no unauthenticated connections | ✅ Active |
84+
| Secret management | `MASTER_KEY` + `JWT_SECRET` via Docker Secrets (not env vars) | ✅ Active |
85+
| CORS policy | Explicit origin whitelist — wildcard `*` rejected at startup | ✅ Active |
86+
| TLS 1.3 | Enforced at API Gateway / Load Balancer | ✅ Active |
87+
| Certificate pinning (mobile) | `network_security_config.xml` — production domain pinned | ✅ Active |
88+
89+
Reference: [STRIDE Threat Model](./docs/THREAT_MODEL_STRIDE.md) · [Compliance Matrix](./docs/COMPLIANCE_MATRIX.md)
90+
91+
---
92+
93+
## 6. Observability & Resilience
94+
95+
| Control | Evidence | Status |
96+
|:--------------------|:----------------------------------------------------------------------|:---------|
97+
| Distributed tracing | `x-request-id` + MDC `trace_id` / `tenant_id` on all responses | ✅ Active |
98+
| SLA commitments | 99.9% availability, P95 latency < 800ms (`/verify`) | ✅ Active |
99+
| Prometheus metrics | `/actuator/prometheus` — protection latency, success/failure counters | ✅ Active |
100+
| Anti-DoS pre-flight | Pixel count (16MP) + payload size (25MB) checked before memory load | ✅ Active |
101+
102+
Reference: [SLA & Incident Response](./SLA_AND_INCIDENTS.md) · [Operations Runbook](./docs/OPERATIONS_RUNBOOK.md)
103+
104+
---
105+
106+
## 7. Penetration Testing & Audit
107+
108+
| Engagement | Scope | Result | Availability |
109+
|:--------------------------------------|:-------------------------------------------------|:-----------------------------------------------------|:-------------------------------------------------------------------------------------------------------|
110+
| Grey-Box API Pentest (2026-01) | Cloud API, Auth flows, Tenant Isolation | 0 Critical · 0 High · Medium/Low resolved within SLA | Redacted summary: [PENTEST_SUMMARY_TEMPLATE.md](./PENTEST_SUMMARY_TEMPLATE.md) · Full report under NDA |
111+
| External Architecture Audit (2026-03) | All 4 repositories — server, core, mobile, cloud | All P0 blockers resolved (H-01, H-02, H-03, B1, B2) | Available under NDA |
112+
113+
---
114+
115+
## 8. Publicly Available Artifacts
116+
117+
All documents below are published at **[https://cyrah2r.github.io/lumatrace-cloud/](https://cyrah2r.github.io/lumatrace-cloud/)**
118+
119+
| Document | Purpose |
120+
|:----------------------------------------------------------------------------|:-----------------------------------------|
121+
| [Trust Center](./TRUST_CENTER.md) | Master index of all governance documents |
122+
| [Security Policy](./SECURITY.md) | Vulnerability disclosure & SLAs |
123+
| [Security Whitepaper](./SECURITY_WHITEPAPER.md) | Architecture & cryptographic controls |
124+
| [SOC2 / ISO27001 Mapping](./SOC2_MAPPING.md) | Control-to-implementation matrix |
125+
| [Data Privacy Policy](./DATA_PRIVACY.md) | GDPR · Zero-Retention · Data residency |
126+
| [SLA & Incident Response](./SLA_AND_INCIDENTS.md) | Uptime SLA · RTO/RPO · Severity matrix |
127+
| [Evidence Pack Summary](./EVIDENCE_PACK_SUMMARY.md) | Pentest status · SBOM · Key management |
128+
| [Pentest Summary (Redacted)](./PENTEST_SUMMARY_TEMPLATE.md) | Methodology · Findings summary |
129+
| [OpenAPI Specification](./api/openapi.yaml) | Full API contract v1.1.0 |
130+
| [Postman Collection](./postman/LumaTrace_Cloud_API.postman_collection.json) | Enterprise integration test suite |
131+
132+
---
133+
134+
## 9. NDA Data Room
135+
136+
Available to qualified enterprise prospects under a signed Mutual NDA:
137+
138+
- Full unredacted Penetration Test report with CVSS scores and remediation evidence
139+
- Complete SOC2 Type II audit report
140+
- ISO 27001 internal control matrix with implementation owners
141+
- SBOM archive (CycloneDX JSON) for all production releases
142+
- Full C2PA cryptographic profile and PKI hierarchy documentation
143+
- Internal STRIDE threat model with risk scoring
144+
145+
**Request access:** enterprise@lumatrace.es
146+
147+
---
148+
149+
*© 2026 LumaTrace. This document may be shared with prospective enterprise customers for due diligence purposes.*

‎TRUST_CENTER.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ This section centralizes public governance and security documentation for procur
1616
- [Authorized Subprocessors & Data Residency](./SUBPROCESSORS.md)
1717
- [Pentest Executive Summary (Template)](./PENTEST_SUMMARY_TEMPLATE.md)
1818
- [Public Evidence Pack Summary](./EVIDENCE_PACK_SUMMARY.md)
19+
- [Public Evidence Index](./PUBLIC_EVIDENCE_INDEX.md)
1920

2021
---
2122

‎api/openapi.yaml‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ info:
2020
**SLA Targets (Production):**
2121
- Availability: 99.9%
2222
- P95 latency: < 800ms (verification)
23-
version: 1.1.0
23+
version: 1.2.0
2424
contact:
2525
name: LumaTrace Enterprise Support
2626
email: enterprise@lumatrace.es
@@ -69,8 +69,12 @@ paths:
6969
operationId: loginTenant
7070
summary: Authenticate Service Account (M2M)
7171
description: |
72-
Validates M2M credentials and returns a signed short-lived JWT.
72+
Validates M2M credentials and returns a signed short-lived JWT.
7373
This is a Machine-to-Machine flow; the returned token enforces tenant isolation and API quotas.
74+
75+
**Multi-tenant authentication:** the `tenantId` field is required to scope the
76+
authentication to a specific organizational boundary. Two tenants may share the same
77+
`username` — the system resolves the identity exclusively within the declared tenant.
7478
tags: ["Identity & Access"]
7579
security: []
7680
requestBody:
@@ -154,7 +158,23 @@ paths:
154158
post:
155159
operationId: protectAsset
156160
summary: Full C2PA & Watermark Protection
157-
description: Injects spatial watermark signal and signs C2PA manifest. Enforces 25MB payload and 16MP resolution limits.
161+
description: |
162+
Injects a spatial spread-spectrum watermark and signs a C2PA JUMBF manifest
163+
into the submitted image asset.
164+
165+
**Output format:** This endpoint **always returns `image/jpeg`** regardless
166+
of the input format (JPEG, PNG, or WEBP). The protected asset undergoes an
167+
RGB conversion and JPEG re-encoding at quality 0.95 as part of the watermark
168+
injection pipeline. Clients must not assume the output format matches the
169+
input format.
170+
171+
**Operational limits:**
172+
- Maximum payload: 25 MB
173+
- Maximum resolution: 16 Megapixels (e.g. 4000×4000 px)
174+
- Supported input formats: `image/jpeg`, `image/png`, `image/webp`
175+
176+
**Idempotency:** supported via `Idempotency-Key` header. Duplicate requests
177+
with the same key within the processing window return the original response.
158178
tags: ["Provenance"]
159179
parameters:
160180
- $ref: '#/components/parameters/IdempotencyKey'
@@ -175,7 +195,9 @@ paths:
175195
description: "Stringified JSON payload matching the PhotoRegistrationRequest schema."
176196
responses:
177197
'200':
178-
description: Protected binary asset.
198+
description: |
199+
Protected binary asset. **Always returned as `image/jpeg`** regardless
200+
of the original input format.
179201
headers:
180202
x-request-id:
181203
$ref: '#/components/headers/x-request-id'
@@ -357,7 +379,7 @@ components:
357379

358380
LoginRequest:
359381
type: object
360-
required: [ tenantId, username, password ]
382+
required: [tenantId, username, password]
361383
properties:
362384
tenantId:
363385
type: string
@@ -416,7 +438,7 @@ components:
416438
example: "550e8400-e29b-41d4-a716-446655440000"
417439
tenantId:
418440
type: string
419-
description: Contextual Tenant ID derived from the session (For debug/correlation).
441+
description: Contextual Tenant ID derived from the session (for debug/correlation).
420442
example: "tenant_alpha_01"
421443
signature:
422444
type: string

0 commit comments

Comments
 (0)