SECURITY

The trust boundary is auditable, not assumed.

AURORA's security posture is engineered, not asserted. Signed weights, hash-chained audit logs, mTLS-only federation, opt-in telemetry, reproducible builds, and a vulnerability-disclosure path with a 72-hour triage SLO. This page is the running specification.

Sigstore-signed releases72h triage SLOno inbound ports requiredair-gap parity
I · Threat model

What we protect against, in plain language.

AURORA is decision-support software handling consented clinical data inside hospital perimeters. The threat surface is asymmetric: a small number of high-impact failure modes, and a large number of low-impact ones. We name the high-impact ones explicitly.

T-01

Silent model tampering

A modified weights file that returns confident-looking but wrong predictions. Mitigated by Sigstore signature verification at load time; the runtime refuses to render unverified weights.

T-02

Audit-log forgery

An attacker rewriting the override log to erase a clinician decision. Mitigated by hash-chained audit entries with per-site federation keys; chains are signed before the next render.

T-03

Federation backchannel

A malicious site exfiltrating data via the federation runtime. Mitigated by signed, rate-limited, schema-validated updates — gradients only, no record-level payloads ever leave a site.

T-04

Supply-chain implant

A compromised dependency landing in an AURORA release. Mitigated by reproducible builds, pinned digests, SBOM published per release, and a 2-of-N maintainer sign-off on artefact promotion.

T-05

Credential reuse

A clinician credential lifted from another system and used against AURORA. Mitigated by per-site OIDC binding, short-lived tokens, per-clinician identity in every audit entry.

T-06

Side-channel inference

An attacker reconstructing training data from model outputs. Mitigated by DP budgets per registry, output-rate limiting, and refusal-mode when input distribution drifts.

T-07

Patient re-identification

Combining outputs across cases to identify a patient. Mitigated by case-bound rendering, no cross-case batch APIs, and consent metadata that travels with records.

T-08

Insider misuse

A privileged site operator running queries outside clinical purpose. Mitigated by role-bound consent policies enforced by the runtime, and an audit log the operator cannot rewrite.

What we do not claim to protect against. Physical access to a site's hardware, hospital-IT-level compromises that already own the EHR, nation-state adversaries with persistent on-prem footholds. These are real risks; they are not AURORA's threat surface and we will not pretend otherwise.

II · Supply chain

Every artefact is signed, pinned and reproducible.

The supply chain is the substrate's most boring and most important property. AURORA's release pipeline is intentionally over-engineered: reproducible builds, hermetic CI, hardware-rooted signing keys, SBOM-per-release, and 2-of-N maintainer attestation on promotion.

  1. Hermetic builds. Every release builds against pinned dependency digests in an isolated, network-restricted CI environment. Builds are reproducible byte-for-byte from the public source.
  2. SBOM. Each release ships a CycloneDX SBOM listing every dependency, version, hash and license. The SBOM is itself signed and published alongside the artefact.
  3. Sigstore. Containers, wheels, weights and Helm charts are signed via Sigstore + Rekor transparency log. The Rekor entry is the source of truth — not the registry.
  4. 2-of-N promotion. Promotion from rc to release requires signatures from two maintainers on different working groups. The promotion is itself a Rekor entry.
  5. Pinned digests. Every Helm chart, OCI bundle and Python wheel references upstream dependencies by digest. latest tags are not used anywhere in the release path.
  6. Provenance attestations. SLSA v1.0 provenance attestations accompany every release artefact, including the CI workflow that built it and the source revision it built from.

If you are a security reviewer, the entry points are the public Rekor entries and the published SBOMs. If you are a pilot site, the runtime verifies all of this for you at install time — aurora doctor exits non-zero if any signature does not chain back to the public key.

III · Runtime hardening

Sandboxed, capability-bound, auditable.

The AURORA runtime makes minimal assumptions about its host. It runs as an unprivileged user, talks to the network only outbound, and refuses to operate without an audit-log sink it can write to.

01

Unprivileged user

Runs as UID 10000 by default. Drops every Linux capability except those required for GPU access (when present). No setuid binaries.

02

Read-only filesystem

Container images mount read-only; writable paths are explicit tmpfs/PVC mounts. SELinux/AppArmor profiles published per release.

03

No inbound

Federation requires only outbound mTLS. The runtime refuses to bind a public-facing inbound port unless the operator explicitly opts in.

04

Memory hardening

PIE + RELRO + stack canaries on every binary. Rust crates compiled with overflow checks on; Python runs with -W error for DeprecationWarnings on security-sensitive paths.

05

Secret hygiene

Federation keys, OIDC client secrets and registry tokens live in Vault / KMS / HSM per site policy. The runtime fetches a short-lived bearer; secrets never land on disk in plaintext.

06

Audit-log sink

If the runtime cannot durably write the audit log, it refuses to render. Sinks supported: local disk, S3-compatible object store, Kafka, syslog. NDJSON over HTTPS is the default.

07

Refusal mode

On signature verification failure, input-distribution drift, or DP budget exhaustion, modules enter refusal mode — they render the refusal and the reason, never a low-confidence prediction.

08

Rate limiting

Per-clinician and per-cohort rate limits enforced by the runtime. Bulk queries against cohorts require a documented research-use token signed by the site's IRB delegate.

IV · Federation security

No central data lake. Outbound mTLS only.

Federation is the most-asked-about security question. The short answer: there is no central data lake. Sites open outbound mTLS connections; the federation control plane orchestrates signed, rate-limited, schema-validated model updates.

What leaves a site

  • Signed gradient updates. Per-round, schema-bound, size-capped. Every update carries a Sigstore signature and the federation-key fingerprint of the contributing site.
  • Update-metadata only. Round identifier, schema version, validation hash, dataset hash. No record-level payloads ever.
  • Optional telemetry, if explicitly enabled. Off by default. The schema for any telemetry is in the module RFC and reviewed by the patient-advocate council.

What never leaves a site

  • Patient records, derived imaging series, or any case-level artefact.
  • Operator credentials, OIDC tokens, federation private keys.
  • Free-text override reasons. They stay in the site's audit log.

The federation control plane

The control plane is a transparency-log-backed service that records every round, every contributing site, every update hash and every validation outcome. Its source is open; its operator is the AURORA foundation; its log is independently mirrored. The control plane sees update metadata, not updates.

V · Model integrity

Pinned weights. Verified at load.

A model is only as trustworthy as the path from training to the GPU that loaded it. AURORA's model-integrity chain is verified at every step.

  1. Training provenance. Each weights drop ships with a training manifest: pinned commit, hermetic build identifier, dataset hash set, DP budget consumed, equity-gate outcome.
  2. Reproducibility recipe. The recipe is the manifest plus a single aurora replicate <run-id> command. Replications drift; the recipe tells you why.
  3. Sigstore signature. The weights file, the manifest, and the model card are signed independently. Modifying any one of the three invalidates the chain.
  4. Load-time verification. The runtime verifies the signature, the dataset-hash compatibility, and the equity-gate outcome before loading the model into memory. Failures route to refusal mode.
  5. Drift detection. Stratified performance is monitored in production where the deployment exposes it. If a stratum crosses its threshold, the module self-quarantines and the council is notified.
VI · The data path

Encrypted in transit, scoped at rest.

Data inside an AURORA deployment moves over TLS 1.3 only; data at rest is encrypted by the site's storage system; consent metadata travels with every record.

DP-01

TLS 1.3 only

Inbound, outbound and intra-cluster traffic. TLS 1.2 is rejected; cipher suites limited to AEAD only.

DP-02

At-rest encryption

AURORA does not impose its own encryption layer over the site's storage; it requires that the underlying volume is encrypted, and refuses to render if a volume's encryption status cannot be verified.

DP-03

Consent metadata

Every record carries a cohort policy. Subsystems with an explicit consent dependency refuse to run on records that lack matching policy.

DP-04

PHI segregation

PHI is processed inside the runtime; derived artefacts (signatures, hashes, audit entries) contain no PHI by construction.

DP-05

Right to withdraw

Patient withdrawals propagate through cohort policies; the site's existing legal flow (GDPR Art. 17, HIPAA, India DPDP) is the binding mechanism, AURORA respects it.

DP-06

Backup posture

AURORA's runtime is stateless; the data path is the site's. We do not back up patient data because we never have it.

VII · Vulnerability disclosure

Report a vulnerability. We move first.

AURORA runs a coordinated disclosure program with a 72-hour triage SLO. We thank researchers in releases and publish a CVE for every fix that warrants one. There is no bounty programme — we are a non-profit — but every disclosure gets a written acknowledgement and a named entry in the release notes.

How to report

  1. Email security@aurora.health with a description, reproduction steps, and any artefacts. Encrypt with the PGP key in the page meta (0x A0F2 · 8C91 · 6E4B · D7A2); the unencrypted address is monitored but encrypted reports are preferred.
  2. If you need a secure channel and can't use PGP, request a one-time encrypted upload link in your initial email — we'll send one within 24 hours.
  3. Disclose to us before public release. We are committed to a 90-day default disclosure window; we will not pressure you to extend it past that.

What we commit to

  • Triage within 72 hours. A real human acknowledges receipt and assigns a severity rating using CVSS 3.1.
  • Fix-or-explain in 21 days. For critical vulnerabilities, a patch lands or we explain in writing why it cannot.
  • Public credit. Your name (or chosen handle) in the release notes, the security advisory, and on this page's hall-of-fame at public alpha.
  • No legal action for good-faith research that respects this policy. We hold ourselves to the same standard we ask of you.

Scope

Everything under github.com/aurora-collective at public alpha, plus the federation control plane, the website, and the published OCI / Helm / wheel artefacts. Out of scope: third-party services hosting our documentation (until they become first-party), social-engineering attacks against staff, and physical-security testing of pilot sites.

VIII · Incident response

If something breaks, we say so. Quickly.

The incident-response playbook is public. It is not a marketing document; it is the document on-call engineers run.

  1. Detect. Stratified-performance monitors, federation-runtime alerts, vulnerability reports, or pilot-site escalations.
  2. Quarantine. Affected modules self-quarantine: predictions still surface but are flagged out-of-spec; the council is notified within 1 hour.
  3. Notify. Pilot sites receive a structured advisory within 4 hours. The advisory says what we know, what we don't, and what the site should do.
  4. Patch. Critical fixes land within 21 days; high within 60; medium within 90. The clock is public.
  5. Postmortem. A written, public postmortem within 14 days of resolution. Blameless, specific, and including the parts where we got it wrong.
  6. Carry forward. Every postmortem produces at least one runtime check, audit entry or RFC. The institutional memory is structural, not optional.

The incident archive lives on the changelog; it is part of the public history of the project. We are not in the business of pretending nothing went wrong.

IX · Compliance posture

Audited where it matters. Honestly where it doesn't.

AURORA is research and decision-support infrastructure; specific clinical deployments are validated and submitted to regulators by the partner institutions. The substrate itself maintains the controls a deployment will need to inherit.

Standards we map to

  • ISO 27001 controls — informally mapped today; formal audit at public alpha for the federation control plane.
  • NIST SSDF v1.1 — the secure-development framework AURORA's release pipeline tracks against. Self-attested today; third-party audit at public alpha.
  • SLSA v1.0 — provenance level 3 on all release artefacts today.
  • GDPR / HIPAA / India DPDP — substrate inherits site obligations; AURORA does not change a patient's existing rights under their local law.
  • FDA SaMD / MDR / TGA — modules destined for clinical use are submitted by the deploying institution; the substrate ships the audit artefacts the submission requires.

What we deliberately do not claim

  • SOC 2. We are not the data processor; sites are. SOC 2 against the substrate would be theatre.
  • HITRUST. Same reason.
  • "Bank-grade security." Banks lose data weekly.
Changelogv0.6.0