Security Guide: ChainIT APIs
ChainIT is committed to delivering secure, reliable, and compliant financial infrastructure through its API platform. Security is not an afterthought, it is embedded at every layer of the API ecosystem, from authentication and network transport to application logic, infrastructure operations, and incident response.
This guide provides a detailed overview of the security controls, practices, and shared responsibilities that govern the ChainIT API platform. Integration teams should read this guide to understand how ChainIT protects the platform and what responsibilities remain with the integrating organization.
API Access Control
Access to ChainIT APIs is controlled through a combination of authentication and authorization mechanisms that together ensure only authorized applications can access only the resources they are permitted to reach.
Access tokens are issued with explicit permission scopes that enumerate exactly which endpoints and operations the token may be used for. An attempt to use a token outside its granted scope results in a 403 Forbidden response. This model ensures that a compromised token has a strictly limited blast radius — it can only be used for the operations that were originally authorized.
Organizations should apply the principle of least privilege when configuring scopes: each integration should be granted only the permissions it needs to function, no more. Separate client credentials with different scope sets are recommended for different integration components.
API Authentication
All ChainIT API requests must be authenticated using the OAuth 2.0 Client Credentials flow. Authentication is performed by presenting a valid client ID and client secret to the token endpoint, which issues a time-limited Bearer token for use in subsequent API requests.
ChainIT API authentication security controls include:
- Client secrets are never stored in plaintext. All secret material is hashed using a cryptographically strong algorithm before storage.
- Token issuance requests are rate-limited to prevent brute-force credential attacks.
- Issued tokens carry a limited lifespan (typically 3600 seconds) to minimize the window of exposure if a token is leaked.
- All token requests and issuances are logged for audit purposes, including the client ID, requested scopes, and source IP address.
Security Monitoring and Incident Response
ChainIT operates a continuous security monitoring program that covers all platform infrastructure and application layers. Monitoring is designed to detect potential security events — including unauthorized access attempts, anomalous traffic patterns, and infrastructure vulnerabilities — as early as possible.
The Incident Response Lifecycle
| Phase | Description |
|---|---|
| Detection | Automated alerting on anomalous events from infrastructure logs, application metrics, and security monitoring tools. |
| Triage | Rapid assessment of the nature, scope, and severity of the detected event. |
| Containment | Immediate actions to limit the impact of a confirmed security incident, including traffic blocking, credential revocation, or system isolation. |
| Remediation | Root cause analysis and implementation of fixes to resolve the underlying vulnerability or misconfiguration. |
| Post-Incident Review | Documentation of the incident timeline, impact, response actions, and lessons learned to prevent recurrence. |
Audit Logging
ChainIT maintains a comprehensive, immutable audit trail of all actions performed within Control Center. Audit logs capture the who, what, when, and where of every significant operation, enabling organizations to maintain accountability, support compliance reporting, and conduct security investigations.
Logged Events
- User authentication events (login, logout, failed attempts, session timeout)
- Role and permission changes
- Customer record creation, modification, and deletion
- Transaction submissions and approvals
- Configuration changes to organizational settings
- Data export and report generation actions
Secure Software Development Lifecycle
Security controls are integrated throughout ChainIT's software development process to catch and address vulnerabilities early, before they can reach production systems.
- Security requirements are defined at the design phase for all new features and infrastructure changes.
- Threat modeling is conducted for significant new capabilities to identify and mitigate architectural risks.
- Code changes undergo peer review with security considerations as a review criterion.
- Automated security testing (SAST, dependency scanning) runs in CI/CD pipelines against every code change.
- Production deployments are staged, with validation gates between environments.
- Rollback capabilities are maintained for all deployments to enable rapid recovery from production issues.
Customer Security Responsibilities
ChainIT and its customers share responsibility for overall security. ChainIT secures the underlying platform infrastructure and API services. Customers are responsible for the security of their own applications and the users that interact with those applications.
Customer Responsibilities
- Secure storage of client credentials : never commit client IDs or secrets to source code repositories.
- Proper access token handling : store tokens in memory or secure storage, not in cookies, local storage, or URLs.
- Application-level access controls : ensure your application enforces appropriate authorization before calling ChainIT APIs on behalf of a user.
- Secure end-user authentication : implement appropriate authentication strength for users interacting with your application.
- Monitoring your own application logs : for anomalous ChainIT API usage patterns.
- Promptly revoking and rotating credentials : upon suspected compromise.