Security model

One rule explains the whole architecture: every arrow points outward. Nothing we run can open a connection to anything you run.

Our side		Your cluster
Relay · rustls, step-ca	← mTLS · 443	Connector · read-only
Query API · api.vedavid.dev	outbound only	Prometheus
D1 · tenants, tokens, denylist		Samples · never leave

What we hold


`tenants`	Org name, verified email domains, cluster names you chose.
`certificates`	Public halves of connector client certs, issued by step-ca. Private keys are generated in your cluster and never transmitted.
`denylist`	Revoked certificate serials, checked on every handshake. Revocation takes effect on the next connection attempt.
not samples	Query results pass through the relay in memory, encrypted end to end, and are never written to disk on our side.

Who can see what

Authorisation is your cluster’s job. The connector issues queries as its own service account, so a namespace it cannot read is a namespace the phone cannot read. There is no second list of users to keep in sync.

kind: Role
metadata:
  name: vedavid-connector
  namespace: monitoring
rules:
  - apiGroups: [""]
    resources: ["services", "endpoints"]
    verbs: ["get", "list"] # read, and nothing else