GPLink Platform — security flow

How a credential is issued, checked, contained and proven

GPLink Platform — security flow How a credential is issued, checked, contained and proven 01 / Declared 02 / Presented 03 / Enforced 04 / Contained 05 / Proven Terraform · name, scope, key policy · 01 / Declared · reviewed as code Terraform name, scope, key policy reviewed as code Three partners · OAuth2 · mTLS · HMAC · 01 / Declared · no shared secret Three partners OAuth2 · mTLS · HMAC no shared secret Secrets Manager · one per integration · 02 / Presented · per environment Secrets Manager one per integration per environment Edge · WAF · rate per partner · 02 / Presented · coarse net Edge WAF · rate per partner coarse net Running task · secret at boot · 03 / Enforced · KMS customer key Running task secret at boot KMS customer key Gateway decision · allowed or refused · 03 / Enforced · correlation id Gateway decision allowed or refused correlation id event_record · envelope stored first · 03 / Enforced · replay source event_record envelope stored first replay source Alarm, suspend · no deploy, no restart · 04 / Contained · next request refused Alarm, suspend no deploy, no restart next request refused Dead letter · held traffic kept · 04 / Contained · never data loss Dead letter held traffic kept never data loss Rotate, replay · old version disabled · 05 / Proven · blast radius of one Rotate, replay old version disabled blast radius of one Audit archive · Object Lock · 05 / Proven · immutable Audit archive Object Lock immutable declares at boot own credential filtered envelope stored in memory only logged held traffic rotated then replay evidence Legend primary data policy / PII async batch data store data flow

Blast radius

  • • One secret per integration, per environment
  • • No shared secret spans two vendors
  • • Rotation touches one partner, not the platform

Containment

  • • Suspension is a gateway refusal, not a deploy
  • • Held traffic is dead-lettered with its full envelope
  • • Containment costs availability, never data

Evidence

  • • Suspension, rotation and replay are audit lines of their own
  • • Archived under Object Lock
  • • Dead-letter depth is itself an alarm