Security Architecture
for Enterprise Buyers
Tenant isolation, append-only audit, encryption, and mutation controls designed for regulated procurement — with an honest posture on certification and pen testing.
What your security team will ask first
| Primary region | AWS eu-west-1 (Ireland) |
|---|---|
| Frontend | Angular SPA via CloudFront + S3 |
| API | Lambda + API Gateway HTTP API v2 |
| Data store | DynamoDB single-table, tenant-scoped keys |
| Secrets | Envelope-encrypted with a dedicated AWS KMS key (server-side only) |
| Authentication | Amazon Cognito (JWT Bearer) |
| AI egress | BYOK — Lambda proxies prompts to your provider; keys never in browser |
Full technical detail: request the security white paper via the vendor pack.
Security controls
Capability status reflects what is available in the service today
Every data access is scoped to verified workspace, studio, and organisation membership. Cross-tenant access is denied by design.
Personas and studio roles govern sensitive resources. Restricted fields and governance actions (approve, role grants) are blocked server-side.
Tamper-resistant audit store with field-level change history. Client-forged attribution is rejected — actor identity comes from the JWT.
TLS in transit and platform-managed encryption at rest. Integration credentials and AI provider keys are additionally envelope-encrypted with a dedicated AWS KMS key, each with its own data key, and never appear in the browser or API responses.
Optimistic concurrency, idempotent lifecycle actions, and immutability on approved records are live for hardened entities. Remaining studio and workspace routes are tracked in our immutable-data programme.
AI calls go through our API with server-owned prompts. Your provider key stays server-side, encrypted with a dedicated AWS KMS key; prompt content egresses only to the provider you configure.
Structured logs with correlation identifiers. No passwords, tokens, or personal data in log lines. Retention aligned to environment policy.
CloudWatch alarms on API and auth error rates; public status endpoint for availability.
Point-in-time recovery for primary data stores with documented recovery objectives. Multi-region failover is not offered today.
Per-IP throttling on authentication flows, request size limits, schema validation, and platform-wide API throttling.
Managed web application firewall at the CDN and API edge. Application-layer controls and throttling are active today.
Honest certification posture
We do not claim certifications we have not earned
- MDTS UK Limited is not currently ISO 27001 or SOC 2 Type II certified.
- We maintain ISO 27001 control mapping and a SOC 2 readiness programme — available in the vendor pack.
- Operational security controls include rate limiting, automated monitoring, and a live status service.
- AI features use BYOK: prompts egress from our Lambda proxy to your configured provider; keys are encrypted server-side with AWS KMS and never reach the browser.
- Access tokens are stored in browser localStorage today; httpOnly refresh cookies are on the hardening roadmap.
- Enterprise governance capabilities include risk register, control mapping, evidence packs, and executive reporting.
- Network allow-list policy can be configured in Security settings; full enforcement is being extended across the platform.
- An independent penetration test aligned to OWASP ASVS Level 2 is planned; no report is published yet.
- Achieving certification requires your own organisational programme and independent assessment.
Running a security review?
Email enterprise@productivityworkbench.com with your SIG Lite or CAIQ template. We respond within one business day with the white paper and sub-processor list.