9.1 Introduction
Security explains how Moonitoring protects its systems, users, and data. Use this section to understand authentication, authorization, trust boundaries, exposed surfaces, and the procedures that reduce or respond to security risk.
Source of truth
Identity, access and audit are drawn on page 9, and security monitoring on page 15, of the architecture diagram, which opens only for Google accounts with access to the file. Update the drawing and these pages together.
9.1.1 Security Architecture¶
Security architecture describes where controls are applied and how identity, access, and data protection fit into the wider system. Our controls follow these decisions:
| Decision | Why |
|---|---|
| No keys. Services and pipelines get short-lived tokens; service account keys cannot be created | A key that does not exist cannot leak |
| People through groups, prod through temporary grants | Nobody holds standing access to customer data, and every grant is recorded |
| Audit logs in a locked archive for 400 days | Not even an administrator can erase what they did |
| One protected front door per environment: load balancer, Cloud Armor in prod, IAP for staff and, in stage, for the testers' group | Everything public crosses the same controls |
| Databases without a public address or passwords: Cloud SQL on a private IP, IAM sign-in | A database nobody can reach from the internet cannot be attacked from it |
Personal data goes only to models in the EU, through one gateway, ai-gateway |
Data residency holds even for prompts |
Continue with Trust Boundaries and Authorization when evaluating who or what may cross a boundary and which actions are permitted, with Secrets Management for the values that grant access, and with Security Monitoring for how we notice when something goes wrong.
9.1.2 Attack Surface¶
The attack surface includes every exposed interface, integration, data path, and operational entry point that could be misused. Use this view to identify where controls, monitoring, and security review are required before a change is introduced.
Today it is:
- the public host names behind the load balancer of prod;
- the Cloud Run services of stage, reachable only through IAP;
- the landing pages and the news site on Cloudflare;
- the upload URLs that farm clients receive, valid for minutes;
- the code host and the CI, which can change the infrastructure;
- the people with access, through their Google Workspace accounts.
A change that adds to this list needs a security review in its pull request.