Platform & Network Security
Planbok's security extends beyond the cryptographic protocol into every layer of our infrastructure. We employ enterprise-grade network protections and encrypted secret management to ensure a resilient and secure operating environment.
Infrastructure Isolation
The core of our "No Single Point of Failure" promise is the physical and logical separation of our MPC nodes.
1. Node Isolation
Node 1 and Node 2 run in independent environments. Each node holds one share, so a compromise of one environment does not expose the other, and only authorized services can reach the MPC engines.
2. Host Separation
Node 1 and Node 2 run on separate hosts, so a compromise or outage affecting one host does not expose both key shares.
Key Material at Rest
Key material is encrypted at rest. Key shares are split across independent nodes and wrapped so that a single storage system cannot open them alone.
Network Protection
1. DDoS Mitigation & WAF
Planbok utilizes advanced WAF (Web Application Firewall) rules and DDoS protection to mitigate automated attacks:
- Rate limiting: Enforced at the edge, and again in the API, which applies a process-wide budget and per-operation budgets on top of it. See API Rate Limits.
- IP Reputation: Blocking of known malicious IPs and botnets.
- Geo-blocking: Optional restriction of API access based on geographic location.
2. API Security
- Internal Transport: Service-to-service traffic is encrypted and mutually authenticated with TLS.
- API Key Scoping: API keys are locked to specific IP addresses and domains, preventing their use if stolen.
- Idempotency: Every critical request (like transactions) is protected by mandatory idempotency keys to prevent duplicate processing during network retries.
Continuous Monitoring
Security is a continuous process. Our platform is monitored 24/7 by:
- Intrusion Detection Systems (IDS): Real-time alerting for suspicious network patterns.
- Automated Vulnerability Scanning: Daily scans of our containers and dependencies for known CVEs.
- Anomaly Detection: Machine learning models that identify unusual transaction patterns or access spikes.