Security Architecture
CTO reference
How TumiTrust protects data and access across API, institution hub, and partner integrations.
Defense in depth
| Layer | Controls |
|---|---|
| Network | Isolated hosting, DDoS protection, TLS |
| Application | Rate limits, input validation |
| Authentication | API keys (TT_SANDBOX / TT_LIVE), JWT for user sessions, OAuth where integrated |
| Authorization | Role-based access, institution-scoped data, context entitlements |
| Data | Encryption at rest and in transit (TLS 1.2+) |
| Audit | Structured logs, screening provenance, compliance center export |
| Monitoring | Health endpoints, status page, alerting |
Authentication surfaces
| Surface | Mechanism |
|---|---|
| Trust platform API | X-API-Key server-to-server |
| Institution hub | Session + team roles |
| Partner webhooks | HMAC signature verification |
| Mobile / web users | Passwordless / MFA options per account settings |
Sandbox keys: see Sandbox and live API keys. Production promotion requires account verification.
Multi-tenancy & PTI-ID
- Institutions operate in dedicated workspaces with role-based team access
- PTI-ID (
pti_+ Crockford Base32, e.g.pti_9A72X8K2) is canonical for partner-provisioned entities - Native members use numeric directory IDs
- Storage residency options per Institution packages (contract)
Encryption & secrets
- Database and object storage encrypted at rest
- API keys stored hashed — never returned after creation
- Secrets rotated through TumiTrust key-management procedures (documented for enterprise customers)
- Documents encrypted before storage; decrypted on-demand for entitled lookups
Audit & compliance logging
- Trust lookups and screening checks record provider_id, checked_at, dataset version
- Compliance Center CSV export for institution auditors
- Fail-closed screening —
unavailablenever reported asclear
Disaster recovery
- Backups with encrypted retention
- Recovery objectives defined per hosting contract
- Status communicated via tumitrust.com/status
Enterprise security documentation
Security due-diligence materials are available in the Resources library and through your institution hub. See Architecture guide for the platform map and Trust governance for data obligations.