Security Architecture — Headx Monitor

1 Executive summary

Headx Monitor is delivered in two forms: Cloud (SaaS) hosted in AWS Mumbai (ap-south-1), and On-Premise deployed inside the customer's own infrastructure with no data leaving the customer perimeter. The platform consists of a code-signed Windows endpoint agent, a Node.js / Express backend API with a real-time Socket.io command channel, and a Laravel 12 administrative dashboard backed by MariaDB.

Security posture at a glance

Control	Implementation
Data in transit	TLS 1.3, HSTS, pinned-certificate agent communication
Data at rest	AES-256 (AWS KMS for Cloud; customer-managed for On-Premise)
Authentication	JWT bearer tokens, tenant header, bcrypt passwords, TOTP / SMS MFA
Authorisation	RBAC with 5 default roles + custom-role support
Audit logging	Every privileged action; immutable-storage option; SIEM export
Network isolation	Multi-tenant SaaS with subdomain isolation; Cloudflare WAF + DDoS
Endpoint security	EV-signed MSI, tamper-resistant service, signed agent ↔ backend channel
Compliance alignment	IT Act 2000, IT Rules 2011, DPDP Act 2023, RBI / IRDAI / SEBI
Certifications	ISO 27001:2022 In progress · SOC 2 Type 2 In progress

2 System architecture overview

2.1 Trust zones

Four distinct trust zones separated by TLS-terminated boundaries:

Endpoint zone — Windows workstations running the Headx agent
Customer perimeter zone — path from endpoint to Cloudflare (Cloud) or fully internal (On-Premise)
Headx Cloud zone — AWS Mumbai infrastructure; ingress / egress via Cloudflare + Apache
Sub-processor zone — third-party services receiving operational metadata only, never customer activity data

2.2 Data flows

Flow	Direction	Transport	Auth
Agent heartbeat	Agent → Backend	HTTPS POST 60s	Bearer + tenant
Activity batch	Agent → Backend	HTTPS POST 30–120s	Bearer + tenant
Screenshot upload	Agent → Backend	HTTPS multipart	Bearer + tenant
Real-time command	Backend → Agent	WebSocket	Persistent bearer
Dashboard query	Browser → Laravel	HTTPS	Session + CSRF
Backend query	Laravel → Node.js	Localhost / TLS	Internal JWT
DB read	App → MariaDB	Socket / VPC-private	Secrets store

Long-lived bearer tokens have a maximum lifetime of 24 hours; agents auto-rotate.

3 Deployment architectures

3.1 Cloud (SaaS) AWS Mumbai

No production data replicated outside India.

EC2 in private subnets, ELB-fronted, auto-scaled per tenant load. No public IPs on application instances.
EBS for application data, S3 for screenshot blobs (AES-256 server-side encrypted, lifecycle-managed)
Managed MariaDB, encrypted at rest, daily automated backups, point-in-time recovery
Cloudflare WAF + DDoS in front of every endpoint; rate limiting per tenant
DNSSEC enabled

Tenant isolation: X-Tenant-ID header enforced in every backend route; database row-level isolation via company_id column scoped at the ORM layer; Cloudflare hostname routing for customer subdomains; tenant-prefixed storage paths.

3.2 On-Premise Air-gap supported

Recommended for BFSI, healthcare, government, and any customer subject to strict data-residency requirements.

Single Windows or Linux server hosts the application stack
All customer data stays on the customer-owned server
No telemetry, no phone-home, no Headx-side data collection unless the customer enables update-checks
Air-gapped deployments fully supported; update packages delivered via signed archive
Customer-managed encryption keys via OS-level KMS (Windows DPAPI, Linux LUKS / Vault)

Headx engineers access On-Premise systems only via customer-initiated screen-share. We hold no copy of customer data.

4 Identity & access management

4.1 Customer-side authentication

Password storage — bcrypt, cost factor 12, salted per user
Sessions — HTTP-only secure cookies, SameSite=Lax, CSRF tokens on every state change
MFA — TOTP and SMS available; enforceable per company
Session timeout — 4 hours default, configurable to 15 minutes
Account lockout — 5 failed attempts → 15-minute lockout
SSO — Azure AD / Okta SAML 2.0 Q3 2026

4.2 Role-based access control

Five default roles: Super Admin, Admin, Manager, Auditor, Viewer. Custom roles can be defined per company with granular permissions across 40+ permission keys.

4.3 Headx-side privileged access

Headx employees have zero default access to customer data. Operational access requires customer-raised ticket, SSO + hardware-key MFA, time-boxed access (auto-revoked after support), full session recording, and audit log shared with the customer. Background-verified employees only. Quarterly access reviews.

5 Data protection

5.1 In transit

TLS 1.3 on all customer-facing endpoints; TLS < 1.2 and weak ciphers disabled
HSTS enforced: max-age=31536000; includeSubDomains
Certificate pinning in the Windows agent — rejects unexpected chains
Internal service-to-service over TLS or localhost-only

5.2 At rest

Database AES-256 at the volume layer; column-level encryption on sensitive columns (PAN, Aadhaar fragments, hashed API keys)
Screenshot blobs: AES-256 server-side on S3 (Cloud) or filesystem-level (On-Premise)
Backups AES-256 with separate KMS keys
Secrets in AWS Secrets Manager (Cloud) or HashiCorp Vault / .env outside webroot (On-Premise)

5.3 Key management

AWS KMS-managed keys with automatic annual rotation
BYOK supported for On-Premise via standard OS keystores
JWT signing keys rotated quarterly; previous keys retained for grace-period validation
Database credentials never in source control; injected at runtime via secrets manager

6 Network security

Cloudflare — WAF tuned for OWASP Top 10; rate limiting per IP and per tenant; DDoS Layer 3-7
Apache reverse proxy — TLS termination, security headers (X-Frame-Options, X-Content-Type-Options, CSP, Referrer-Policy)
Server firewall — only 80 / 443 / 22 (key-only SSH) externally; all internal-service ports bound to localhost
SSH — public-key only; password authentication disabled; fail2ban active
VPC isolation — application instances in non-public subnets; no peering with non-Headx VPCs
Egress controls — application instances allowed only to known sub-processor endpoints

7 Endpoint agent security

Binary integrity

Agent MSI signed with an Extended Validation (EV) code-signing certificate
SHA-256 fingerprints published for AV whitelisting
Submitted to Microsoft Defender, CrowdStrike, Trend Micro, Symantec, McAfee, Kaspersky, SentinelOne

Runtime & communication

Windows service under a dedicated low-privilege account
Uninstall requires admin privilege and is audit-logged
HTTPS with pinned certificate; bearer token scoped to enrolled company; HMAC payload signing
Replay protection via timestamped requests
Offline encrypted queue; flushes when connectivity restored

Telemetry transparency

System-tray icon during active sessions
Consent prompt on first run; consent stored locally and confirmed with backend
User can pause monitoring during scheduled break windows (where customer policy enables)

8 Application security

Secure SDLC

Every commit via pull request; production merges require approving review
Static analysis (PHPStan, ESLint + SonarJS, Roslyn analyzers)
SCA on every dependency update; SLA on critical CVEs 24h, high 7d
Annual external penetration test by CERT-In-empanelled firm
Quarterly internal red-team exercises against staging

OWASP Top 10 mitigations

Risk	Mitigation
Broken access control	Tenant guard middleware on every API route; row-level ORM scoping
Cryptographic failures	TLS 1.3, AES-256, bcrypt, no proprietary crypto
Injection	Parameterized queries, input validation, output encoding
Insecure design	STRIDE threat modelling on every major feature
Misconfiguration	Hardened base images; secrets in vault; IaC reviewed
Vulnerable components	Dependabot + Snyk with CVE-driven patch SLAs
Auth failures	bcrypt, MFA, rate-limiting, lockouts, session timeouts
Software integrity	Code-signed agent; signed update packages
Logging & monitoring	Centralised aggregation; SIEM export; anomaly alerting
SSRF	Outbound egress allowlist; no user-controlled URLs server-side

9 Threat model (STRIDE)

Category	Asset	Mitigation
Spoofing	Customer admin account	MFA, anomalous-login UEBA, session tying
Spoofing	Endpoint agent identity	Per-agent enrolment key, signed channel, HMAC
Tampering	Activity logs	Append-only logs; daily integrity hashes; SIEM forwarding
Tampering	Agent binary	EV-signed MSI; runtime integrity check; missing-heartbeat detection
Repudiation	Admin actions	Every action audit-logged with ID, IP, before/after state
Information disclosure	Cross-tenant data	Tenant guard on every request; row-level scoping; integration tests
Information disclosure	Screenshot URLs	Signed short-lived URLs (15 min) with tenant ID + HMAC
DoS	Backend API	Cloudflare DDoS; rate limiting per IP and per tenant token
DoS	Agent telemetry	Per-agent rate limits; agent circuit breaker
Elevation of privilege	Customer user	Role-change requires super-admin reconfirmation; audit-logged
Elevation of privilege	Headx employee	Zero default access; time-boxed; session recording; quarterly review

10 Compliance & standards

India statutory

IT Act 2000 (and 2008 amendment) — Section 43A reasonable security practices
IT Rules 2011 — consent, notice, retention, breach reporting
DPDP Act 2023 — granular consent, data-principal rights, Grievance Officer see status

Sector frameworks (aligned)

RBI Master Direction on Outsourcing of IT Services (Apr 2023); Cyber Security Framework for Banks (Jun 2016)
IRDAI Information and Cyber Security Guidelines (2017, current)
SEBI Cybersecurity and Cyber Resilience Framework (Aug 2022)

International standards

Standard	Status	Target
ISO 27001:2022	Stage 2 audit in progress	Q2 2026 details
SOC 2 Type 2	Observation window	Q3 2026
GDPR	DPA available	Now
HIPAA	BAA available	Now
PCI DSS	Out of scope	Cardholder data handled by Cashfree / Razorpay

We do not claim certifications we have not yet earned. Interim attestations and audit timelines available under NDA.

11 Operations & incident response

Detection

24×7 monitoring of infrastructure, application, and security events
Centralised log aggregation with anomaly detection
Alerting on failed-login spikes, privilege escalations, unusual egress, off-window changes, sub-processor outages

Response SLAs

Phase	SLA
Detection to confirmation	1 hour (high-severity)
Containment	2 hours of confirmation
Customer notification	72 hours (DPDP alignment)
Public disclosure	30 days post-resolution if customer data affected
Post-mortem	30 days to affected customers

Regulator notification

CERT-In — within 6 hours per 28 April 2022 directive
Data Protection Board of India — per DPDP Act 2023 Section 8(6) (once Board is constituted)
Sector regulators — RBI / IRDAI / SEBI timelines honoured for relevant customers

12 Sub-processors

Sub-processor	Purpose	Data accessed	Location
Amazon Web Services	Compute, storage, database	All customer data encrypted	Mumbai (ap-south-1)
Cloudflare	CDN, WAF, DDoS	Traffic metadata only	Global edge
Cashfree Payments	Subscription billing	Customer billing details	India
Razorpay	Alternative billing	Customer billing details	India
Postmark / Resend	Transactional email	Email addresses + body	US (minimised)
Sentry	Error monitoring	Stack traces (PII scrubbed)	US

On-Premise customers have zero sub-processors — all data flows are inside the customer's own infrastructure.

13 Audit logging

Every admin login (success / failure with IP, user agent, geolocation), every privileged operation, every access by Headx personnel, every configuration change, every sub-processor data flow (metadata).

Retention — 3 years default; configurable up to 7 years for regulated customers
Storage — immutable storage (S3 Object Lock for Cloud)
Tamper-detection — daily integrity hashes
SIEM export — JSON, CEF, syslog (RFC 5424). Forwarders for Splunk, Sentinel, Elastic, QRadar.

14 Business continuity & disaster recovery

Cloud

Metric	Value
Recovery Time Objective (RTO)	4 hours for major incidents
Recovery Point Objective (RPO)	1 hour (WAL + hourly snapshots)
Backup strategy	Daily full + hourly incremental; cross-AZ within ap-south-1; 30-day retention
Failover	Multi-AZ with automatic DB failover; instances auto-replaced
DR rehearsal	Semi-annual full-restore test
SLA	99.9% uptime measured monthly

On-Premise

Customer-owned backup strategy. Headx provides tooling and documentation. Quarterly DR rehearsal recommended; available on paid engagement.

15 Vulnerability management

Internal

Continuous SAST on every commit
Daily SCA dependency scans
Monthly internal vulnerability scans (staging)
Quarterly internal vulnerability scans (production)
Annual external penetration test (CERT-In empanelled firm)

Responsible disclosure

Report vulnerabilities to security@headx.in. Acknowledgement 4 hours (24×7); confirmation 48 hours; patch SLA: critical 24h, high 7d, medium 30d, low 90d. Bug bounty available case-by-case for responsibly disclosed high-severity issues.

16 Data subject rights & deletion

Right	How to exercise	SLA
Right to know	privacy@headx.in	Ack 48h, fulfil 30d
Right to correction	privacy@headx.in	Ack 48h, fulfil 30d
Right to erasure	privacy@headx.in	Ack 48h, fulfil 30d (subject to retention)
Right to nominate	Written form on file	Honoured per nomination
Right to withdraw consent	Self-service or via Grievance Officer	Immediate effect

Cloud cancellation: full export window 30 days; production deletion within 90 days; backup deletion within 180 days.

17 Security roadmap

Item	Status	Target
ISO 27001:2022 certification	In progress	Q2 2026
SOC 2 Type 2 attestation	In progress	Q3 2026
SSO (SAML 2.0 — Azure AD, Okta)	Planned	Q3 2026
Customer-managed keys (BYOK) for Cloud	Planned	Q4 2026
FedRAMP-aligned controls (government)	Planned	2027
Mac and Linux agent	Planned	2027
Confidential-compute deployment (AWS Nitro Enclaves)	Planned	2027