What Secure Raven actually does
Connection modes, encryption, retention, and release gates — without claiming HIPAA certification, a finished SOC 2 report, or a completed pen test.
Claims we do not make
- Not a HIPAA certification. Connecting a source does not create a BAA.
- Not independently audited for SOC 2 Type I or Type II.
- External penetration test is not commissioned yet. Scope is written; there is no report date.
- We do not sit in front of your API. Watch is inspection, not a WAF.
Connection modes
Public website scan
Held by Secure Raven: None
web
Subscriber-hosted push probe
Held by Secure Raven: Ingest token + HMAC only. No database credential.
supabase recommended
Restricted Postgres scanner role
Held by Secure Raven: Dedicated login with no BYPASSRLS and no table DML
direct Postgres when approved
Privileged Supabase API mode
Held by Secure Raven: service_role or sb_secret_ key
optional, highest risk, off in production
Shield apply
Held by Secure Raven: None by default. Subscriber pastes digest-bound signed SQL.
never implicit
Encryption
AES-256-GCM envelope v3 bound to tenant, source, kind, and format.
External KMS wrap/unwrap. Local KEK is refused in production unless ENVELOPE_ALLOW_LOCAL_KEK is explicitly set.
What we retain
- Events: 90 days, then purged.
- Resolved findings: 730 days after resolve/accept, then purged.
- Terminal agent runs: 365 days, then purged.
- Audit log: never deleted. Tenant export is head hash and counts only.
Subprocessors
- Supabase — Postgres, Auth, Edge Functions
- Vercel — Application hosting
- GitHub — Source and CI
Findings, events, and credentials are not sent to an LLM vendor.
Release gates
Gate A — Safe beta code complete · production off
Public web scan and subscriber-hosted push probe. Privileged credentials stay off in production by default.
Gate B — Restricted direct scan code complete · production off
Restricted scanner role and MFA/step-up exist in code. Independent SQL review is still required before calling this gate open.
Gate C — Privileged Supabase API mode blocked · production off
Blocked until an external pen test closes critical/high findings. Privileged mode is optional and off in production unless explicitly enabled.
Gate D — Remote Shield apply blocked · production off
Default apply is subscriber-executed signed SQL. REMOTE_SHIELD_APPLY_ENABLED stays off.
Gate E — Regulated data blocked · production off
REGULATED_DATA_CONNECTIONS_ENABLED stays off until BAA, subprocessors, and counsel approve HIPAA operational scope. A signed BAA is not a certification.
SLOs we will measure
Targets only. These are not live product metrics yet.
- credential.unwrap_success — 99.9% excluding revoked or disconnected sources
- credential.time_to_revoke — Next claim cycle; queued jobs skipped
- scan.isolation — 100% of planned and claimed runs
- ingest.hmac_rejection — 100% of fail-closed production traffic
- shield.rollback_time — Flag off immediately; no global remote apply
Disclosure
Report vulnerabilities to security@secureraven.com. Do not include PHI, credentials, or customer payloads.