{"type":"excalidraw","version":2,"source":"https://AwesomeSystemDesign.dev","elements":[{"angle":0,"strokeColor":"#6577aa","backgroundColor":"#eef1fc","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-1"}],"updated":0,"link":null,"locked":false,"id":"shape-0","type":"rectangle","seed":41,"x":36,"y":32,"width":325.70392,"height":68,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-1"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-1","type":"text","seed":114,"x":56,"y":54.3,"width":285.70392,"height":23.400000000000002,"fontSize":18,"fontFamily":1,"text":"Requirement | Free | Pro | Ent.","originalText":"Requirement | Free | Pro | Ent.","textAlign":"center","verticalAlign":"middle","containerId":"shape-0","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":1}},{"angle":0,"strokeColor":"#628572","backgroundColor":"#edf5ee","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-3"}],"updated":0,"link":null,"locked":false,"id":"shape-2","type":"rectangle","seed":187,"x":401.70392000000004,"y":32.000000000000014,"width":280.61788,"height":246.6,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-2"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-3","type":"text","seed":260,"x":421.70392000000004,"y":50.000000000000014,"width":240.61788,"height":210.6,"fontSize":18,"fontFamily":1,"text":"SOC 2 Type II | ✓ | ✓ | ✓\nGDPR | ✓ | ✓ | ✓\nData residency | - | - | ✓\nHIPAA BAA | - | - | ✓\nBYOK encryption | - | - | ✓\nAudit log export | - | ✓ |\n✓\nSSO / SAML | - | - | ✓\nIP allowlisting | - | - | ✓","originalText":"SOC 2 Type II | ✓ | ✓ | ✓\nGDPR | ✓ | ✓ | ✓\nData residency | - | - | ✓\nHIPAA BAA | - | - | ✓\nBYOK encryption | - | - | ✓\nAudit log export | - | ✓ |\n✓\nSSO / SAML | - | - | ✓\nIP allowlisting | - | - | ✓","textAlign":"center","verticalAlign":"middle","containerId":"shape-2","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":2}},{"angle":0,"strokeColor":"#a68a53","backgroundColor":"#fff7e6","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":[{"type":"text","id":"shape-5"}],"updated":0,"link":null,"locked":false,"id":"shape-4","type":"rectangle","seed":333,"x":36,"y":318.6,"width":591.5922,"height":654.8000000000001,"customData":{"revealStep":3}},{"angle":0,"strokeColor":"#394557","backgroundColor":"transparent","fillStyle":"solid","strokeWidth":1.5,"strokeStyle":"solid","roughness":0.7,"opacity":100,"version":1,"versionNonce":1,"isDeleted":false,"groupIds":["step-3"],"frameId":null,"roundness":null,"boundElements":null,"updated":0,"link":null,"locked":false,"id":"shape-5","type":"text","seed":406,"x":56,"y":336.6,"width":551.5922,"height":618.8000000000001,"fontSize":17,"fontFamily":1,"text":"Security Layers for Multi-Tenant SaaS\n\nAuthentication:\n• JWT tokens with tenant_id + user_id + roles\n• Refresh token rotation (detect token theft)\n• Enterprise: SAML SSO / OIDC integration (Okta, Azure AD)\n• MFA enforcement per tenant (admin configurable)\n\nAuthorization:\n• RBAC within tenant (admin, member, viewer, custom roles)\n• Role definitions configurable per tenant\n• API-level: middleware checks role + feature flag\n• Resource-level: check ownership/team membership\n\nData Encryption:\n• In-transit: TLS 1.3 everywhere\n• At-rest: AES-256 for all storage\n• Enterprise: customer-managed encryption keys (BYOK)\n→ AWS KMS with customer's key ARN\n→ Customer revokes key → their data becomes unreadable\n\nCompliance:\n\nAudit Trail:\nEvery state-changing API call logged:\n{tenant_id, user_id, action, resource, timestamp, ip, result}\nImmutable append-only store (S3 + ClickHouse)\nEnterprise: exportable to customer's SIEM (Splunk, Datadog)","originalText":"Security Layers for Multi-Tenant SaaS\n\nAuthentication:\n• JWT tokens with tenant_id + user_id + roles\n• Refresh token rotation (detect token theft)\n• Enterprise: SAML SSO / OIDC integration (Okta, Azure AD)\n• MFA enforcement per tenant (admin configurable)\n\nAuthorization:\n• RBAC within tenant (admin, member, viewer, custom roles)\n• Role definitions configurable per tenant\n• API-level: middleware checks role + feature flag\n• Resource-level: check ownership/team membership\n\nData Encryption:\n• In-transit: TLS 1.3 everywhere\n• At-rest: AES-256 for all storage\n• Enterprise: customer-managed encryption keys (BYOK)\n→ AWS KMS with customer's key ARN\n→ Customer revokes key → their data becomes unreadable\n\nCompliance:\n\nAudit Trail:\nEvery state-changing API call logged:\n{tenant_id, user_id, action, resource, timestamp, ip, result}\nImmutable append-only store (S3 + ClickHouse)\nEnterprise: exportable to customer's SIEM (Splunk, Datadog)","textAlign":"left","verticalAlign":"middle","containerId":"shape-4","lineHeight":1.3,"autoResize":false,"customData":{"revealStep":3}}],"appState":{"viewBackgroundColor":"#fbfbf8","gridSize":null},"files":{}}