How a deployment is built

Every AWS account is a hard boundary. AWS itself enforces that one account cannot read another account’s resources, network, or data unless something is explicitly configured to allow it. We do not configure that access.

Core customers share a single multi-tenant AWS account, with application-level separation between customers. Silo and Sovereign customers each get a dedicated AWS account, so their workload, network, and encryption keys are not shared with any other customer’s account at all.

Single-tenant account isolation is a risk-posture choice we offer, not something mandated by any regulation. No compliance standard requires a dedicated AWS account per customer. We offer it because a dedicated account is the clearest way to guarantee that one customer’s incident cannot become another customer’s incident, and because it lets a customer read our AWS Config, CloudTrail, and Security Hub data directly for their own account rather than trusting our word for it.

Storage is encrypted using AWS KMS, customer-managed keys rather than AWS’s shared default keys. Production separates keys by domain — six distinct key aliases — so a compromise of one key does not expose every category of stored data.

To be precise about what that does and does not cover: this is storage-level encryption. It protects data written to disk and to backups, which is what defends against a lost volume or an exposed snapshot. It is a separate question from whether any individual field inside the database is additionally encrypted on its own, and we are not making a blanket claim here that every stored field is. We would rather state the narrower true thing than the broader one.

The production database is Amazon Aurora MySQL Serverless v2 running Multi-AZ, meaning it replicates across multiple physically separate data centers automatically. It is encrypted at rest, keeps a 30-day backup retention window, has deletion protection enabled so it cannot be dropped by accident or a single mistaken command, authenticates database connections through IAM rather than long-lived static passwords alone, and is not reachable from the public internet.

All EveryBill workloads are restricted to a single AWS region, us-east-1, enforced by an AWS Organizations service control policy. A service control policy is an account-level guardrail: it blocks the creation of resources outside the approved region at the permissions layer, not just by convention or internal policy document. Data does not move to another region because no one on our team, including administrators, has permission to create it there.