ShipStream Data Border

Documentation

Deployment Security

This page describes the security measures implemented in ShipStream Data Border deployments.

Deployment Security

This page describes the security measures implemented in ShipStream Data Border deployments.

Security Architecture

Data Border implements defense-in-depth with multiple security layers:

  • TLS 1.3: All connections encrypted with modern TLS
  • Web Application Firewall: Protection against common attacks
  • Rate Limiting: Per-endpoint and per-IP throttling
  • Authentication: Multi-layer token validation

TLS Configuration

Data Border enforces strict TLS settings:

SettingValuePurpose
ProtocolTLS 1.3 onlyNo legacy protocol support
HTTPSRequiredHTTP automatically redirected
CertificatesValid CA-signedNo self-signed certificates

Secrets Management

Data Border requires several secrets for operation. All secrets are:

  • Stored in platform-managed secret stores (never in code)
  • Encrypted at rest
  • Rotated according to security policy

Client-Provided Secrets

The amazonTokenSecret is provided by WMS clients and:

  • Never stored in Data Border infrastructure
  • Used only for encrypting Amazon tokens
  • Must be securely managed by the WMS

Data Protection

Encryption at Rest

All stored data is encrypted:

  • Database: Platform-provided volume encryption
  • Object storage: Server-side encryption (SSE)
  • Secrets: Platform-managed encryption

Encryption in Transit

All data in transit is encrypted:

  • External: TLS 1.3 for all API calls
  • Internal: Encrypted connections to storage and external services

Web Application Firewall

Data Border uses WAF protection for:

  • SQL injection detection
  • Cross-site scripting (XSS) prevention
  • Bot detection and blocking
  • Suspicious activity monitoring
WAF is optional but strongly recommended for production deployments.

Security Headers

Data Border sets security headers on all responses:

Content-Security-Policy: default-src 'none'

This strict CSP is appropriate for API-only services.

Health Monitoring

Health check endpoints are available for monitoring without exposing sensitive information:

  • /health-check - Basic system health
  • Components verified: Database, Storage

See Health Check API for details.

Compliance

Data Border is designed to support compliance with:

  • Amazon Data Protection Policy (DPP)
  • SOC 2 requirements (via cloud provider certifications)
  • Data encryption requirements

Related Documentation