Security Architecture
How signed tasks, scoped credentials, TLS, and access rules protect deployments
Warden starts outbound HTTPS connections to the LaserData control plane, the services that manage deployments. Signed tasks, signed binaries, and scoped credentials protect that management path. Application clients connect directly to deployment endpoints through TLS and access rules.
Security Model
Thick arrows show requests initiated by Warden. Dashed arrows show telemetry sent outbound from Warden. The control plane does not initiate inbound connections to nodes.
Stream UI loads through the Console, then connects from the browser to Warden's HTTP proxy. Its short-lived Ed25519-signed session is limited to one deployment and user. Iggy payloads do not pass through the LaserData backend.
Stream UI is isolated from the surrounding Console. An access rule must permit the browser IP, as for any other Iggy HTTP client.
Pull-Based Architecture
Warden starts every management connection from the node. The control plane supplies tasks through those outbound connections. It does not open an inbound connection to your infrastructure.
| Data Flow | Direction | Description |
|---|---|---|
| Config, tasks, certificates | Pulled by Warden | Warden polls the control plane over HTTPS |
| Heartbeats, metrics | Pushed by Warden | Warden reports node health outbound |
| Inbound management connections | None | Warden polls outbound. Client listeners are controlled separately |
This model has three requirements:
- Warden trusts authorized tasks from the control plane. Task-signing keys and control-plane identity remain security boundaries.
- Nodes need outbound HTTPS for management. Client traffic needs separate inbound access.
- Management requires no SSH keys, cloud-specific management agents, or bastion hosts.
Network Isolation
| Property | Managed | BYOC | On-Premise |
|---|---|---|---|
| Control plane can push commands | No | No | No |
| SSH access | None | None | None |
| SSM access | None | None | None |
| Inbound management connection from control plane | None | None | None |
| Customer data leaves infrastructure | N/A | No | No |
| LaserData has network access to endpoints | No | No | No |
Paid deployments need access rules before clients can connect. Managed Free deployments include a global rule. Application messages travel directly between clients and deployment nodes.
Encryption
| What | How |
|---|---|
| In transit | TLS on all connections - Warden to control plane, client to Iggy |
| NVMe SSD at rest | Encrypted at the hardware level by the cloud provider |
| Network disks at rest | Encryption always enabled (EBS on AWS, Persistent Disk on GCP) |
| Custom key encryption | Optional per-deployment encryption with a custom key on top of disk encryption |
| Certificate lifecycle | Automated issuance and rotation - no manual intervention |
| Audit data | Encrypted at rest, including actor names and event payloads |
Binary Integrity
Warden, Iggy, and Connectors binaries use cryptographic signatures. Before it executes a downloaded binary, Warden makes sure that its signature matches the LaserData public key. It rejects a binary with an invalid signature, including an unsigned replacement from a compromised download channel.
Task Signing
The control plane signs each operational task with Ed25519. Warden makes sure that the signature is valid before execution. This authenticates the task's origin and detects changes in transit.
Credential Scope
Warden Tokens
Each Warden agent uses an Ed25519-signed token limited to one node. This token grants management API permissions. It is separate from Iggy client credentials used to read or write application data. See Warden Agent.
Provisioning Credentials
BYOC Deployments
On AWS, LaserData assumes an IAM role for provisioning. The role grants these permissions:
| Permission Scope | Purpose |
|---|---|
| EC2 lifecycle | Provisioning and maintenance |
| Networking | VPC, subnets, security groups, NLB |
| EBS | Storage management |
It does not include S3, Secrets Manager, CloudWatch, or SSM.
On GCP, LaserData impersonates a service account with these permissions:
| Permission Scope | Purpose |
|---|---|
| Compute instances | Provisioning and maintenance |
| Networking | VPC, subnets, firewall rules, routes |
| IAM | Service account binding to instances |
It does not include Cloud Storage, Secret Manager, or Cloud Logging. Neither provider's provisioning permissions grant access to application data.
Managed Deployments
Managed nodes use minimal cloud credentials. Warden uses credentials created for the node during provisioning. Nodes do not receive broad cloud API access.
Multi-Cloud Consistency
Warden uses HTTPS on cloud instances or physical servers. The management model remains the same across providers. It does not depend on cloud-specific management agents.