Hub security review

Checked

Tenant isolation: Every query is scoped to the signed-in organisation, and the database refuses other organisations' rows in the product's transactions.
Credentials: Stored as hashes. API keys are scoped; a key that sends records reads no evidence and configures nothing.
Staff access: Read-only. Any action taken on an organisation's behalf is logged against the person who took it.
Audit log: The running service cannot edit or delete it; its database role lacks the permission.
Request limits: Size and time limits. A batch with one malformed record is refused whole.
Rate limits: Per credential. A refused request is told when to retry, and the sender keeps its records.
Sign-in and sign-up: Accounts are created only for admitted addresses and invitees; others join the waiting list. Sign-in links, verification attempts, invitations and organisation creation are limited per client address, per mailbox and per person.
Onward delivery: Reaches public addresses over HTTPS only, following no redirect. The credential a destination issued is sealed and never returned.
Policy distribution: Signed. An installed copy accepts policy only from its pinned key and requests it under its own signature.
Secrets in code: None: no keys, secrets or customer names in the code or its test data.
Retention: Enforced: twelve months by default, shortenable by the owner. Delivered records are deleted on request and purged thirty days after the organisation closes.

Deployment model: One service for many organisations behind one public address, which browsers, enrolled machines and publishers reach from the internet. The same code runs as a single-organisation service on a private network.
Policy validation: The hub validates policy against the edge’s source-policy contract before publication. Each receiving edge also checks the signature and loads the policy locally.
Applied policy: The hub’s delivered source records do not establish which policy every edge has applied. The policy in force is available on each edge through commonmeasure status.

Audit log: Protected against the service's own statements, not against arbitrary commands on its database connection. Closing it is a deployment change.
Replay window: A captured signed request could be replayed within five minutes. It travels encrypted and returns only that organisation's policy.
Database isolation: Covers the product's handlers; account-management handlers rely on the application filter.
Hand-minted keys in reports: A record-sending key an owner minted by hand can deliver a session under an enrolled machine's key id, and the reports list it under that machine.
Waiting-list volume: Submissions are limited per client address, so someone holding many addresses can add many entries. There is no challenge on the form; entries create no account and send no mail.
Content security policy: Not yet set on the web interface.