Security Architecture
Bunnylynk is engineered to handle sensitive financial, customer, and operational data across distributed environments.
Access
API Keys & Permissions
Fine-grained scoped API keys with project isolation and automatic expiration.
Governance
Role-Based Access (RBAC)
Manage team members across Admin, Developer, and Read-Only roles.
Integrity
Signature Verification
Cryptographic HMAC-SHA256 verification for Stripe, Shopify, GitHub, and custom senders.
Zero-Trust Data Handling
- Encryption in Transit: All traffic over TLS 1.3 with strict modern cipher suites.
- Encryption at Rest: Sensitive headers, webhook signing secrets, and payloads encrypted using AES-256-GCM.
- Tenant Isolation: Multi-tenant workspaces are logically partitioned; events and keys cannot cross project boundaries.