Whitepaper · WP-04 · Segal Industries
The Security Dossier
Threat posture, tamper evidence, sovereignty guarantees, and audit readiness — the RFP security section, pre-written.
Threat posture
The threats that matter to government records are insider tampering, privileged abuse, exfiltration, and continuity loss. ASTRAEA's design answer, in order: hash-chained audit with external anchoring (tampering becomes detectable by anyone); query-layer sealed-class enforcement plus branch-scoped RBAC with mandatory 2FA (abuse is constrained and logged); envelope encryption with government key custody options (exfiltration yields ciphertext); documented RPO/RTO with restore drills and WORM-postured document storage (continuity is rehearsed, not hoped).
Tamper evidence in depth
Every state action appends an event whose hash covers the previous hash and canonical payload. Per-entity sub-chains allow single-record proofs; daily checkpoints allow global proofs; optional OpenTimestamps anchoring to Bitcoin makes the checkpoint's existence independently verifiable without trusting any vendor, ministry, or intermediary — including us.
Sovereignty
Three deployment models: managed sovereign cloud (residency-bounded), on-premise, air-gapped (signed-media updates). Keys in the government's KMS/HSM where provided. Packs keep legal logic in the government's hands as reviewable data. Exit is contractual and technical: full-fidelity export formats are documented from day one.
Assurance
OWASP ASVS L2+ verification target; dependency-audit gates in CI; signed releases; annual third-party security audit expected in steady state; supreme-audit-institution access patterns designed in. Sealed-record invisibility and reconciliation gates are part of the rollout methodology itself — security assertions are tested as adoption gates, not after incidents.