Security architecture: isolation, encryption & access

Tenant isolation (app + database)

LexCore is multi-tenant by design, and isolation is enforced twice. A deny-by-default query guard auto-scopes every tenant-owned and matter-scoped query to the requesting tenant. Database-level Row-Level Security backstops it, so even a coding mistake can't leak across tenants — with a startup check that refuses to trust RLS if the database role could bypass it.

Encryption

Documents are encrypted at rest with AES-256-GCM; production requires an encryption key, which can be sourced from a KMS. In-transit traffic uses TLS. Envelope encryption and rotation are the documented next step.

Access control

• Authentication via Auth0 with a real tenant-membership check on every request; the production guard refuses to boot without its identity provider configured (fail-fast rather than silently allowing access).
• Authorization via a roles guard on destructive/admin routes, plus step-up MFA on sensitive actions.
• Service-to-service auth between the internal services, with the provisioning credential bound to a tenant.
• Edge baseline — rate limiting, security headers, request-id correlation, strict input validation, and a deny-by-default CORS allowlist in production.