System Specifications and Requirements Documentation
Version
1.0
Effective Date
April 2026
Review Cycle
Annual
Document Owner
Chief Information Security Officer (CISO)
Classification
CONFIDENTIAL — Internal Use Only
Applicable Standard
SOC 2 Type II
1. Purpose
This document details the technical specifications and requirements for how data and items are stored, processed, and maintained within DCKAP Integrator — providing a complete technical reference for the platform’s architecture, infrastructure requirements, and data handling capabilities.
2. Infrastructure Specifications
Component
Specification
Redundancy
Cloud Provider
AWS (primary), with multi-region active-passive failover
Multi-AZ
API Gateway
Managed API gateway with WAF, rate limiting, TLS termination
Multi-AZ load balanced
Integration Engine
Containerised microservices (Kubernetes)
Horizontal autoscaling
Message Queue
Managed queue service (durable, at-least-once delivery)
Cross-AZ replication
Config Database
Managed relational DB (PostgreSQL)
Multi-AZ with read replica
Secrets Vault
Managed secrets management service
Multi-AZ
Log Aggregation
Centralised log service with immutability controls
Cross-region replication
CDN / Portal Hosting
Global CDN with DDoS protection
Global edge network
3. Data Handling Requirements
3.1 Data in Transit
All data in transit uses TLS 1.2 or higher — TLS 1.0 and 1.1 are disabled.
Certificate pinning applied for high-sensitivity connector endpoints (configurable).
Mutual TLS (mTLS) available for enterprise connectors requiring certificate-based auth.
3.2 Data at Rest
AES-256 encryption for all persistent data stores.
Database encryption keys managed by the cloud KMS service.
Customer-specific encryption keys for credential vault (customer-managed key option available on Enterprise tier).
3.3 Data Processing Requirements
Requirement
Specification
Enforcement
Processing Isolation
Each customer’s jobs run in isolated execution contexts
Kubernetes namespace isolation
Memory Limits
Max 2GB per processing job (configurable up to 8GB Enterprise)
Container resource limits
Timeout Limits
Max 30 minutes per sync job before forced timeout and alert
Job scheduler timeout config
Concurrency
Up to 10 concurrent sync jobs per customer (Enterprise: 50)
Per-tenant concurrency limiter
Data Residency
Customer data processed in configured region only
Region-locked job scheduler
4. API Specification Requirements
All DCKAP REST APIs conform to OpenAPI 3.0 specification.
Authentication: OAuth 2.0 (PKCE flow for portal); API key for machine-to-machine.
Rate limits: 1,000 requests/minute per customer (Enterprise: custom negotiated).
Versioning: API versions supported for minimum 24 months after deprecation notice.
