Skip to content

Security & Auditing

Thoth is built with enterprise security as a top priority, featuring multiple layers of protection and comprehensive tracking.

1. Multi-Tenancy Isolation

Thoth uses a Schema-per-Tenant architecture.

  • Physical Isolation: Each tenant's data resides in its own database schema.

  • Request Identification: The tenant is identified by the incoming request hostname (e.g., tenant-a.thoth-studio.com).

  • Data Safety: Even in the event of a critical software bug, it is physically impossible for a query from one tenant to access data from another tenant's schema.

2. Secrets Management

Sensitive information like database passwords, API tokens, and private keys are never stored in plain text.

  • Encryption: All values in the Secrets section are encrypted at rest using AES-256.

  • Tenant-Specific Salts: Each tenant has a unique salt and initialization vector (IV) for encryption.

  • Usage: Secrets are only decrypted in memory at the moment they are needed to establish a connection (e.g., when a JDBC datasource is executed).

3. Audit Logging

Every write operation in Thoth is automatically logged to an immutable audit table.

  • What is logged:

    • The action (Create, Update, Delete, Publish, etc.)
    • The user who performed the action.
    • The timestamp.
    • The specific resource affected.
    • The before and after state (for most resources).

  • Visibility: Audit logs can be viewed in the Audit Logs section by users with the ADMIN permission.

4. API Security

  • JWT Tokens: All web sessions use signed JSON Web Tokens.

  • RSQL Filtering: All API list endpoints use RSQL for filtering, ensuring that only allowed resources are returned even if a user attempts to manually manipulate API calls.

  • RBAC: Every single API endpoint is protected by Role-Based Access Control checks.

5. Printing Security

  • Outbound Only: The Printing Client does not open any ports. It only initiates outbound HTTPS connections to the Thoth server.

  • Key/Secret Authentication: Each Printing Client uses its own unique Client Key and hashed Client Secret to authenticate its requests.

  • Job Expiration: Print jobs are transient and are automatically cleaned up after successful execution or after a configurable retention period.