perimeter

At rest

AES-256-GCM
BA_MASTER_KEY

Auth

API key in X-BA-Key
argon2id at rest

HMAC-SHA256
Stripe-style X-BA-Signature

JWT for WS clients

mTLS optional per source

client cert verify

TLS 1.2+ LB

services

PG

CH

RD