Skip to content
Combine Data Controller

Security

CDC’s security stance, for assessment against an organisation’s security bar.

  • Security posture: the default-deny stance, the trust boundaries, and the controls around identity, access, secrets, and data. Start here.
  • Identity and authentication: the OIDC/OAuth model, the group-granted scope vocabulary, the secure-by-default public surface, and brokering sign-in to a corporate directory.
  • Secrets posture: the write-only secret store, the pluggable backends, the local master key, and live rotation.