> For the complete documentation index, see [llms.txt](https://docs.bitsafe.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/security-architecture.md).

# Security architecture

[Decentralization Manager architecture overview](/decentralization-manager/overview.md)

### Security model

Decentralization Manager combines host controls, operator authentication, Canton authorization, encrypted peer communication, protected local state, supply-chain controls, and on-ledger governance. No single layer secures the whole deployment.

Each organization operates its own instance and controls its accounts, identity provider, Canton credentials, local storage, network exposure, peer records, and upgrades. On-ledger governance limits application actions; it does not protect a compromised host or incorrect off-ledger input.

### Trust boundaries

{% code expandable="true" %}

```mermaid
flowchart LR
  A["Operator browser"] -->|"HTTPS and OIDC"| B["Decentralization Manager HTTP application"]
  B -->|"Identity and tokens"| C["Identity provider"]
  B -->|"Local state"| D["Noise key, database, and DARs"]
  B -->|"Privileged connection"| E["Canton Admin API"]
  B -->|"Party-authorized connection"| F["Canton Ledger API"]
  B <-->|"Encrypted allowlisted peer transport"| G["Peer Decentralization Manager"]
  E --> H["Canton participant"]
  F --> H
  H --> I["Canton Network"]
```

{% endcode %}

Treat every arrow as a separate boundary requiring the appropriate authentication, authorization, encryption, validation, logging, and failure handling.

### Control ownership

<table data-search="false"><thead><tr><th>Boundary</th><th>Primary controls</th><th>Canonical procedure</th></tr></thead><tbody><tr><td>Operator access</td><td>OIDC, PKCE, role enforcement, session and account controls</td><td><a href="/pages/wN8pJHbCs9d8rybGvy8F">Decentralization Manager authentication and operator roles</a></td></tr><tr><td>Canton connections</td><td>Separate Admin and Ledger credentials, least privilege, restricted network paths, TLS or mTLS</td><td><a href="/pages/QdZNlHpFUOaalYFKQbeE">Decentralization Manager production deployment</a></td></tr><tr><td>Peer communication</td><td>Persistent Noise identity, encrypted transport, allowlisted keys, out-of-band verification</td><td><a href="/pages/N4IVRMCXsLxAu1s2o4Ty">Connect Decentralization Manager peers</a></td></tr><tr><td>Persistent data</td><td>Restricted storage, database encryption, protected backups, consistent recovery</td><td><a href="/pages/MMoIOl2pg3SSR1hx1LYc">Decentralization Manager backup, recovery, and mesh upgrades</a></td></tr><tr><td>DAR supply chain</td><td>Approved source, version pinning, hashes, review, and package comparison</td><td><a href="/pages/TAHt1EKnYlbKHKECr7JE">Decentralization Manager package and contract operations</a></td></tr><tr><td>Governance</td><td>On-ledger proposals, confirmations, active rules, execution, expiry, and result verification</td><td><a href="/pages/mES48C5f36Np8SUElWxG">Decentralization Manager governance lifecycle</a></td></tr><tr><td>Release compatibility</td><td>Approved versions, peer protocol, migrations, known issues, and support status</td><td><a href="/pages/F3Br7HqUurD871sXmTvG">Decentralization Manager compatibility, releases, and troubleshooting</a></td></tr></tbody></table>

### Threat model and residual risks

* **Compromised operator account:** can invoke the routes and Canton rights available to that identity.
* **Compromised host:** can expose local credentials, falsify the UI, interrupt workflows, or misuse assigned Canton rights.
* **Wrong peer record:** creates encrypted trust with the wrong endpoint; encryption cannot replace identity verification.
* **Lost or replaced Noise identity:** changes how peers recognize the instance and requires coordinated replacement.
* **Malicious or incompatible DAR:** can affect application behavior despite successful distribution.
* **Mixed peer versions:** can interrupt coordination when protocol compatibility changes.
* **Coordinator failure:** can stop workflow progress without invalidating the existing Decentralized Party.
* **Inconsistent restore:** can preserve only part of the identity, credential, package, or workflow state.
* **Sensitive logs or support exports:** can leak credentials or confidential identifiers if not sanitized.

### Governance limits

Governance authorizes application actions on Canton; it does not prove that every input, package, host, or external system is safe. Members must review the proposal, referenced contracts, package versions, and expected effects before confirming.

Do not use a fixed approval count as a universal product property. Production rules and any intentional design constraints must be documented for the supported release.

### Audit and disclosure

Audit pages identify the reviewed commit, components, dates, exclusions, design acknowledgements, and remediation status. An audit is point-in-time evidence, not a guarantee for every deployment or future release.

Use one approved private vulnerability-reporting route. Do not report unpatched vulnerabilities through public issues or discussions.

### Technical sources

* [Security policy](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/SECURITY.md)
* [Architecture](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/ARCHITECTURE.md)
* [Deployment guide](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/DEPLOYMENT_GUIDE.md)
* [Audit design acknowledgements](https://github.com/DLC-link/decentralization-manager/blob/76d7156c85e605abc008e5fadf8aaa97f4706471/docs/audit-acknowledgements.md)

### Next step

👉 **Apply the controls:** [Decentralization Manager production deployment](/decentralization-manager/get-started/production-deployment.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bitsafe.finance/decentralization-manager/operations-and-reference/security-architecture.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.