APEX Trust Layer

1. Overview

APEX is a multi-tenant AI platform built on AWS that provides solutions architecture guidance, opportunity management, and co-sell tooling for AWS partners. This document describes the technical controls that protect customer data at every layer of the platform.

Everything described here is implemented in production infrastructure defined as CloudFormation templates and application code — not aspirational policy. Where a control is designed but not yet deployed, it is explicitly noted.

2. Data Flow Architecture

When a user interacts with APEX, data moves through the following path:

Key properties of this flow:

• All traffic is encrypted in transit (TLS 1.2+ minimum at every hop)
• WAF inspects all requests before they reach the application (rate limiting, bot control, XSS/SQLi protection)
• The backend runs in a VPC private subnet with no public IP address
• Bedrock processes the prompt and returns the response — it does not retain the data
• Conversation content is stored only in the tenant's own DynamoDB tables — nowhere else
• No conversation content is written to any log, monitoring system, or audit trail

3. Tenant Isolation Model

APEX uses full resource isolation — not row-level filtering, not shared tables with tenant ID columns. Each tenant gets their own dedicated AWS resources.

Per-Tenant Resources

Application-Level Scoping

Resource isolation is reinforced at the application level:

• All DynamoDB queries use partition key filtering scoped to the requesting user or chat
• Chat ownership is verified on every request — the service checks owner_user_id before returning data
• RBAC visibility rules control which users can see which chats (owners see their own, read-only roles can view others, platform admins can view all within the tenant)
• Cross-tenant access is architecturally impossible — each tenant's application instance connects only to its own tables and buckets via IAM role scoping

4. Encryption

At Rest

KMS key policy grants access only to the tenant's EC2 role and specific AWS service principals (S3, DynamoDB, Secrets Manager, Bedrock, CloudWatch Logs). Root account retains administrative access for key recovery.

In Transit

All S3 buckets include bucket policies that deny any request made without SSL (aws:SecureTransport: false).

5. Conversation Privacy

Default: Zero Content Logging

APEX does not log, store, or retain conversation content outside of the tenant's own DynamoDB tables. This is a deliberate architectural decision, not a default setting.

Audit records are written to S3 partitioned by tenant, date, and session — containing only the metadata listed above.

Bedrock Invocation Logging

Bedrock model invocation logging is disabled. No CloudWatch, S3, or any other destination receives conversation content from Bedrock API calls. This is enforced at the infrastructure level — there is no configuration to enable it.

Data Access

Customers can download their conversation data at any time. The full conversation history is stored in the tenant's chat-messages DynamoDB table and is available for export.

Opt-In Content Logging

If a customer's compliance requirements mandate conversation content logging, this can be enabled on a per-tenant basis. Content logs are stored in the tenant's own S3 bucket, encrypted with the tenant's KMS key, and billed to the tenant's usage. This is not enabled by default for any tenant.

No Model Training

Customer data is never used to train, fine-tune, evaluate, or improve any AI model. This is guaranteed by AWS Bedrock's data processing terms — customer data processed through Bedrock is not used by AWS or the model provider for any purpose beyond generating the immediate response.

6. Authentication & Access Control

Cognito-Based Authentication

Every tenant has a dedicated Amazon Cognito user pool. All API requests (except /api/health and /api/auth/config) require a valid JWT Bearer token validated against the tenant's Cognito user pool.

• Token format: JWT (RS256)
• Token validation: Signature, expiration, issuer, audience verified on every request
• Token source: Authorization header (Bearer token)

Role-Based Access Control (RBAC)

APEX enforces 9 Cognito groups server-side via Python decorators — not client-side checks:

Self-approval is blocked on all approval workflows — the submitter and approver must be different users.

Federation & SSO

• SAML 2.0 and OIDC federation supported via Cognito identity providers
• Pre-Token-Generation Lambda automatically provisions federated users on first login
• IdP group membership mapped to APEX roles via custom:idp_groups claim

SCIM 2.0 User Provisioning

APEX supports SCIM 2.0 for automated user lifecycle management with enterprise identity providers (Entra ID, Okta, OneLogin). SCIM endpoints authenticate via a dedicated bearer token stored in AWS Secrets Manager, rotatable without application redeployment.

Session Management

• Sessions stored in DynamoDB with TTL-based automatic expiration (configurable, default 1 hour)
• Expired sessions automatically deleted by DynamoDB TTL
• Login events tracked with 15-minute debouncing to prevent excessive writes

7. AI Safety Controls

Prompt Injection Detection

APEX inspects user inputs before they reach the AI model. Detection covers:

• Base64 obfuscation: Detects encoded blocks (40+ characters) containing injection signals (ignore, instruction, override, system, execute)
• Leet speak density: Identifies high concentrations of digit-for-letter substitutions in alphabetic context (5+ substitutions)
• Fake directive markers: Detects patterns like [SYSTEM UPDATE], [OVERRIDE], ASSISTANT DIRECTIVE, and similar prompt injection patterns

Uniform Refusal Handling

When an injection is detected or the model returns an empty response, APEX returns an identical refusal message in both cases. This prevents attackers from distinguishing between a detected injection and a model failure — they get no signal about whether their attack was identified.

Scope Validation

Model responses are validated against the APEX domain. Responses that fall outside the platform's scope (e.g., attempting to discuss unrelated topics) trigger a guardrail refusal that redirects the conversation.

Context Window Management

Bedrock context window limits are caught and handled gracefully. Users receive a clear error message rather than a failed request or truncated response.

8. Network Security

VPC Architecture

• All application compute runs in VPC private subnets — no public IP addresses on any application instance
• Application Load Balancer (ALB) in public subnets handles all ingress traffic
• Multi-AZ deployment: ALB and Auto Scaling Group span 2+ Availability Zones

VPC Endpoints

Traffic to AWS services stays on the AWS backbone and never traverses the public internet:

VPC Endpoints are transparent to application code — the AWS SDK automatically routes through them when they exist in the VPC. No code changes are needed.

Web Application Firewall (WAF)

WAF is deployed on the ALB with the following rules:

• Rate limiting: 2,000 requests per 5-minute window per IP address (blocks at 2,001st request)
• Bot control: AWS Managed Rules — Bot Control (monitoring mode, switchable to block)
• Common rule set: AWS Managed Rules — Common Rule Set (blocks XSS, SQL injection, path traversal, and other OWASP Top 10 attacks)
• Metrics: SampledRequests enabled on all rules for visibility and tuning

No SSH Access

EC2 instances have no SSH keys provisioned. All infrastructure access uses AWS Systems Manager Session Manager, which provides audited, IAM-authenticated access without opening inbound ports.

Security Groups

Security groups follow the principle of least privilege and reference other security groups rather than CIDR blocks:

• ALB: Inbound 80/443 only
• Backend: Inbound only from ALB security group on port 8080
• Frontend: Inbound only from ALB security group on port 3000

9. Human-in-the-Loop Controls

Chat Review Workflow

All AI-generated content intended for customers goes through a review process:

1. User creates a chat and works with the AI assistant
2. User submits the chat for review (status: PENDING_REVIEW)
3. Reviewer (Solutions Architect or SA Manager) reviews the content
4. Reviewer can approve, reject (with required comments), or request revision (sends back to submitter with feedback)
5. Every state change is recorded with user_id, timestamp, and comments

Self-review is enforced at the route level — the submitter and approver must be different users.

ACE Opportunity Pipeline

Opportunities submitted to AWS Partner Central go through a separate approval workflow:

1. Sales representative drafts an opportunity (pre-filled from conversation context)
2. Opportunity Manager reviews in the approval queue
3. On approval, APEX calls the AWS Partner Central Selling API to create the opportunity
4. Approval records stored in DynamoDB with 30-day TTL expiration

Cross-Account Security (ACE Integration)

When APEX submits opportunities to AWS Partner Central on behalf of a tenant:

• The tenant's APN-linked AWS account has an IAM role that trusts the APEX platform account
• The role requires a unique External ID per tenant (prevents confused deputy attacks)
• APEX assumes the role temporarily — credentials expire after 1 hour
• Every API call is logged in the partner's own AWS CloudTrail

10. Backup & Recovery

DynamoDB Point-in-Time Recovery (PITR)

• Enabled on all 11 tenant tables
• 35-day continuous backup window
• Granular recovery to any second within the window

S3 Versioning

• Chat-docs, tenant-config, and audit buckets have versioning enabled
• Noncurrent versions expire after 90 days
• Incomplete multipart uploads aborted after 7 days
• Transition to Infrequent Access storage class after 30 days

Deletion Protection

All stateful CloudFormation resources (DynamoDB tables, S3 buckets, KMS keys, CloudWatch Log Groups) have DeletionPolicy: Retain. This prevents accidental data loss if a CloudFormation stack is deleted.

Recovery Targets

Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are documented in operational runbooks with tested procedures for each resource type.

11. Monitoring & Incident Detection

CloudWatch Alarms

Alarms notify a per-tenant SNS topic with email subscription.

Application Logging

• Structured format: APEX_{MODULE}_{FUNCTION} prefix with key=value pairs
• All data values truncated to 100 characters maximum
• PII and secrets are never logged
• Log levels: INFO (business events), WARNING (auth failures, recoverable issues), ERROR (exceptions)

12. Subprocessors

All customer data processing occurs within AWS services in the us-east-1 region. No other third-party processors touch customer data.

Document Control

Change Log