Security Model

Overview

HyperMesh implements a layered security model designed for enterprise deployments in regulated industries (healthcare, defense, financial services).

Authentication

HyperMesh uses API key-based authentication with role-based access control (RBAC).

Key Roles

Role	Permissions
admin	Full access: DDL, DML, key management, backup/restore
readwrite	Insert, delete, compact, query
readonly	Query and analytics only

Key Management

# Create a new API key
hmdb keys create --role readwrite --description "ETL pipeline"

# List active keys
hmdb keys list

# Revoke a key
hmdb keys revoke hmdb_abc123

Keys are stored as bcrypt hashes in the schema database. The plaintext is shown only at creation time.

Encryption

At Rest

• Database files (TPI, FMI, PSI, WAL) are stored as binary indexes on disk
• For encryption at rest, deploy on an encrypted filesystem (LUKS, AWS EBS encryption, Azure Disk Encryption)
• Schema metadata (SQLite) supports SQLCipher for column-level encryption

In Transit

• The REST API server (hmdb serve) supports TLS via --tls-cert and --tls-key flags
• Client SDKs verify TLS certificates by default (verify_ssl=True)

hmdb serve --tls-cert /etc/ssl/certs/hypermesh.pem \
           --tls-key /etc/ssl/private/hypermesh.key \
           --port 8443

Network Security

• Bind to specific interfaces with --host (default: 127.0.0.1)
• Rate limiting configurable via HMDB_RATE_LIMIT environment variable
• Health endpoints (/health/live, /health/ready) do not require authentication

Audit Logging

When HMDB_AUDIT_LOG is set, all mutating operations are logged with:

• Timestamp (UTC)
• API key identifier (not the key itself)
• Operation type (INSERT, DELETE, CREATE TABLE, etc.)
• Affected table and record count

Compliance

HyperMesh is designed to support compliance with:

• SOC 2 Type II — audit logging, access controls, encryption
• HIPAA — PHI isolation via table-level access, encryption at rest/in transit
• FedRAMP — deployable in GovCloud regions with FIPS 140-2 validated TLS

For detailed compliance documentation and attestation letters, contact security@hypermeshai.com.

Responsible Disclosure

Report security vulnerabilities to security@hypermeshai.com. We follow a 90-day disclosure timeline and acknowledge reports within 48 hours.