How the security model works
Tenant-scoped access
Authenticated requests resolve a tenant, organization, division, and user context. Application authorization and scoped database queries restrict access according to that context and the user’s assigned role.
Document separation
S3 document keys are organized by tenant, organization, division, pod, and user. This is logical separation within the configured storage environment; it does not imply a dedicated AWS account or bucket for every customer unless separately arranged.
System-owned content
DeveloperNet may publish authenticated, read-only application help, policies, and shared product assets from a separate system namespace. Customer tenant administrators and document owners cannot modify this cross-tenant content.
Encryption at rest
Document uploads request Amazon S3 server-side encryption using AES-256, or AWS KMS when a KMS key is configured. Tenant-specific AES-256-GCM encryption is available for supported user profile fields when enabled by an administrator.
Encryption in transit
Hosted production endpoints should terminate HTTPS/TLS, and the application communicates with Amazon S3 over verified HTTPS. TLS certificates and proxy configuration remain part of the production deployment.
Identity and permissions
The application supports password authentication, organization-managed roles, tenant-scoped administration, and configured SSO providers. Access should follow least-privilege assignments and be removed when no longer needed.
Application safeguards
Security headers, mutation-origin checks, request identifiers, rate limiting, credential hashing support, and permission checks are part of the application layer. Their effectiveness depends on correct production configuration and operations.
Shared responsibility
DeveloperNet Mission Control provides application controls, but customers and deployment operators also control important safeguards. They are responsible for cloud-account permissions, network and proxy configuration, TLS certificates, identity-provider settings, user roles, retention choices, backups, endpoint security, and incident procedures.
Customer-managed encryption keys, dedicated infrastructure, retention commitments, service levels, and regulatory addenda apply only when configured or included in a written customer agreement.
Tenant SSO and user provisioning
Enterprise tenants can connect a SAML 2.0 or OpenID Connect identity provider to an Amazon Cognito user pool selected by the service operator. Cognito brokers the customer identity provider; Mission Control uses an OAuth 2.0 authorization-code flow with PKCE and validates the Cognito ID token issuer, audience, signature, state, and nonce before creating an application session.
Email is the only required identity attribute. Optional attributes include first name, last name, job position, department, organization, division, subdivision, team or POD, and developer role. Incoming role attributes cannot grant administrator, tenant administrator, manager, or global administrator access. Organizational values are accepted only through mappings configured for that tenant.
SAML through Cognito
Provide Cognito with the customer IdP metadata URL or XML and map the customer email attribute to the Cognito email attribute. The sample is a placeholder structure and contains no usable certificate or customer identifier.
OpenID Connect through Cognito
Configure the external issuer, client credentials, scopes, and attribute mappings in Cognito. Use authorization code flow and request at least openid email.
SCIM-compatible provisioning
Each tenant receives a separate SCIM base URL and high-entropy bearer token. Phase-one provisioning supports user creation or update, lookup by email, and activation or deactivation. Tokens are shown once, stored as hashes, rate limited, and replaceable by a global administrator.
Cognito triggers and Lambda
A Cognito Lambda trigger may call the tenant SCIM endpoint when a customer needs event-driven synchronization. The Lambda should retrieve its tenant token from AWS Secrets Manager and must not embed the token in source code, claims, browser configuration, or public metadata.
Attribute contract
{
"email": "john.doe@example.com",
"given_name": "John",
"family_name": "Doe",
"custom:job_position": "Software Engineer",
"custom:department": "Engineering",
"custom:division": "Platform",
"custom:subdivision": "Developer Experience",
"custom:team": "Mission Control",
"custom:role": "Developer"
}The public samples contain generic placeholders only. Tenant IDs, Cognito app-client secrets, SCIM tokens, certificates, internal database identifiers, and customer mappings are available only through authenticated Global Admin controls.
Implementation references: Amazon Cognito identity-provider configuration, Cognito authorization endpoint, and SCIM protocol specification (RFC 7644).
Privacy and legal resources
These public pages describe the service’s general practices and the responsibilities of customers that manage organization workspaces.
Compliance and assurance
This page describes product architecture and operational expectations; it does not itself certify compliance with CCPA, GDPR, SOC 2, ISO 27001, HIPAA, PCI DSS, or another legal or assurance framework. Applicability depends on the customer, data, deployment, contracts, and operating practices.
The CCPA is commonly referred to as the “CCPA, as amended” because the CPRA amended the CCPA rather than creating a separate replacement law. Privacy rights and required workflows vary by jurisdiction and should be reviewed with qualified counsel.
Authoritative references: California Attorney General — CCPA, California Privacy Protection Agency regulations, and European Commission — GDPR rights.
Questions and security reports
Users should first contact the administrator responsible for their organization workspace. Customers may use the support or security contact identified in their order form, service agreement, or deployment documentation. Do not include passwords, encryption keys, or sensitive personal data in an initial report.
Relationship to customer agreements
This security overview is informational and does not amend the Terms of Service, an order form, data processing addendum, SLA, or other written agreement. If this page conflicts with an executed customer agreement, the executed agreement controls.