Security, Access, and Governance

Objectives

• Protect client and platform credentials
• Enforce least-privilege access for humans and automation
• Maintain auditability across tenants
• Isolate multi-tenant data

Credential management

Never commit secrets to git. .gitignore blocks common patterns.

Access model

Human identity (portal and dashboards)

Decision direction (Jul 2026): adopt Identity Platform for client and operator login. Auth0 / Okta remain a fallback if corporate SAML is mandated before launch. Cloudflare Zero Trust Access was evaluated as an IAP alternative for System Ops only — not for the client portal (per-user pricing does not scale to 1,000+ SMB clients). Cloudflare remains in scope for Phase 2+ tag relay (ADR 0005), not for portal auth.

Platform OAuth (Google Ads, Meta Marketing API, TikTok) is automation and onboarding consent — not end-user portal login.

Clients

• Access Kobico dashboard only (Identity Platform — any email; magic link supported)
• No direct ad platform admin
• Optional GA4 viewer on their property

Kobico operators (Human Touch Dashboard)

• RBAC: Viewer, Operator, Planner, Admin, Auditor
• Identity Platform or corporate SSO; MFA required for Admin (implementation phase)
• Approvals, plan diffs, tenant timeline — no raw logs or engineering statistics

Kobico system users (System Ops Dashboard)

• RBAC: system_viewer, system_developer, sre, system_admin — see System Ops Dashboard
• IAP required on all routes; VPN recommended for production
• Logs, QC/Cost Guard statistics, infra health — disjoint IAM from operator roles by default

Automation

• Dedicated service accounts per environment
• Scoped IAM: only required API permissions
• No shared tokens across tenants

Platform access patterns

Scope matrices, rate-limit tiers, app review requirements, and billing activation: Platform access & API readiness.

Multi-tenant isolation

Four layers — all keyed on tenant_id:

Also:

• Separate encryption keys per tenant for sensitive config (optional premium)
• Append-only audit log for approvals, executions, credential use

Implementation status and pilot gate

Go-live gate: multi-tenant isolation (including BigQuery RLS and cross-tenant query denial) must pass verification before live pilot ads. No separate security product purchase — GCP-native stack (Identity Platform + Secret Manager + CMEK + audit).

Independent security audit (pentest)

Scope (planned): web app + BFF API, Identity Platform auth flows, tenant isolation, Secret Manager usage, onboarding paths — black-box + grey-box. SOC 2 is a separate Phase 2+ track, not bundled with pentest. Firm not yet selected.

Audit

• Append-only audit log for approvals, executions, credential use
• Cloud Logging retention aligned with compliance (min 1 year operational, 7 years financial TBD)
• Export for external audit on request

Network security

• Private connectivity to CRM where possible
• Egress allowlist for platform APIs
• WAF on Human Touch dashboard endpoints (implementation phase)
• System Ops Dashboard — not public; IAP-only (+ VPN for prod); separate Cloud Run service from Human Touch BFF

Incident response

Reliability, backup & disaster recovery

Planning-level targets — confirm with the implementation team and the parent platform's SRE standards before GA. Phase 1 pilots can run looser; these are the GA targets.

Service-level objectives (internal SLO; client SLA set commercially by parent/VC)

Agent runs are async and idempotent (campaign-execution) — a control-plane outage delays work, it does not corrupt campaigns. No external client uptime SLA is promised by this module unless the parent/VC contracts one.

RTO / RPO targets by data class

DR posture

• Region: primary in the agreed EU/TR-aligned region (GCP topology — data residency); cross-region backups for registry + audit.
• Recovery: infra is IaC-defined → redeploy stateless Cloud Run services to a recovery region; restore registry from PITR/export; secrets re-provisioned from Secret Manager.
• DR drill: restore-from-backup rehearsal before GA and at least annually; document actual measured RTO/RPO vs targets.
• Idempotency safety net: because mutations dedupe by run_id, replaying queued work after recovery will not double-create campaigns or double-spend.

Platform account suspension & business continuity

The single largest concentration risk: an agency-level suspension (Google MCC, Meta BM, TikTok BC) can take all tenants on that platform dark at once. This is the operational runbook for gameplan B8.

Compliance

• Module data boundary (ADR 0004): this module does not store PII or client financial data; CRM and billing live in sibling systems. CAPI / offline conversion pipelines deferred — revisit hash-only rules when built.
• Legal confirm required: KVKK/GDPR applicability, entity jurisdiction (TR vs EU), and prod region lock — ask legal team before go-live despite the narrow datastore boundary above.
• Consent Mode and privacy policy linkage (when relay/CAPI land)
• Health and education ad policies enforced in agent guardrails
• Client approval of data sharing with sub-processors/vendors and marketing use — see Vision & scope — Client agreements
• Client bears responsibility for lawfulness of data they permit to flow to ad networks and analytics; Kobico operates only on approved, versioned configurations

Vendor access

• No third-party agency access to tenant accounts without contract
• Sub-processor / vendor access limited to client-approved scope recorded at onboarding and plan approval

Related documents

• Human-in-the-loop
• GCP topology
• System Ops Dashboard
• Human control plane