Trust boundaries
Controls by layer
| Layer | Controls |
|---|---|
| Edge | 61 custom firewall rules, 5 rate limits, managed WAF, IP and user-agent blocks, HSTS, HTTPS redirect, sanctioned-market gate at the Worker |
| Origin authentication | Finder: per-hostname client certificates from Cloudflare (own certificate authority per environment, weekly renewal, expiry alerts) and mutual TLS at production load balancers; security groups admit Cloudflare ranges only |
| Edge decision integrity | HMAC-SHA256 signed headers with a 300 s window; incoming copies stripped |
| Pre-launch access | Basic auth on web hosts; Drupal Shield on all environments, with content API, file and webhook paths exempt |
| Member identity | Cognito; secure httpOnly cookies; PKCE on the fallback flow; sign-out accepts POST only and checks the origin |
| Service identity | IAM SigV4 for search queries; a content-only search role for Drupal; machine token for PADI APIs held on the server |
| Personal data | Telemetry redaction; personal pages never cached; finder copy excludes personal, banking and legal columns |
| Consent | TrustArc records consent choices; Datadog RUM and device fingerprinting do not wait for them, as PADI's TrustArc notice allows |