Kenyan SACCOs, clinics, and law firms routinely move sensitive files — National IDs, M-Pesa statements, lab scans, signed contracts — over email and WhatsApp with no encryption, no expiry, and no audit trail. TrustCapsule is a HarLyn Digital Partners product built to close that gap without asking anyone to migrate systems: it wraps an outbound file into a self-destructing, watermarked, tamper-evident capsule with an automated compliance certificate attached.
This is a record of the security architecture I designed and own within the product, built jointly with Harry Ndeke under HarLyn Digital Partners.
Engagement context
| Product | TrustCapsule — internal HarLyn Digital Partners product |
|---|---|
| My role | Chief Security & Compliance Architect — cryptography, PII detection, regulatory compliance, forensic watermarking |
| Delivery partner | Harry Ndeke — web app, API, infrastructure, viewer, SDK, extensions |
| Status | Core platform built and tested (CI: build, test, dependency audit, secret scan). Not yet handling a first live client document — the master encryption key is deliberately rotated immediately before that happens, since rotation after go-live would make every stored capsule permanently undecryptable by design. |
The security model
This is the part that matters, so it comes first — the same principle the product itself is built on.
| Control | Implementation |
|---|---|
| Encryption at rest | Every document body and attachment is sealed with AES-256-GCM (PBKDF2-SHA256, 100k iterations, per-capsule salt + IV) before it reaches storage. Plaintext never touches Postgres. |
| API authentication | Bearer API keys compared in constant time. Fails closed — with no keys configured, the API refuses to serve capsule data at all. |
| Tenant isolation | Capsules are scoped to the key that created them. Another tenant's capsule returns 404, not 403, so ownership itself is not an oracle. |
| Recipient access | Public share links carry a 256-bit access token in the URL fragment — never sent in a request line, never in access logs, never leaked via Referer. Only its SHA-256 hash is stored. |
| Self-destruct | On expiry or view exhaustion the sealed ciphertext is purged, not flagged, enforced by a database constraint. A scheduled sweep additionally purges capsules nobody opened. |
| Audit trail | Append-only HMAC-SHA256 hash chain — each event commits to the previous signature. A database trigger blocks UPDATE/DELETE so even the service role cannot rewrite history. |
| Database | Row-level security enabled and forced on every table, zero permissive policies, plus explicit REVOKE for anon/authenticated roles. |
Compliance, not just cryptography
Encryption alone does not satisfy a regulator. TrustCapsule generates compliance certificates directly from each capsule's real audit chain and policy configuration, mapped against the frameworks that actually apply to Kenyan businesses handling sensitive data:
- Kenya Data Protection Act (2019) — ODPC statutory compliance and fine-exposure mitigation.
- EU GDPR — Article 32 zero-trust security of processing.
- HIPAA — for diagnostic scans and health data.
Architecture
TrustCapsule is a monorepo: a Next.js 15 web app (API, dashboard, secure viewer), a Chrome extension for WhatsApp Web and Gmail, and a background worker running the capsule-destruction state machine. Shared packages handle cryptography, Kenyan-specific PII detection (National ID, KRA PIN, M-Pesa statement patterns), compliance validation and certificate generation, and a JS client SDK. A WordPress integration proxies API calls server-side so the API key never reaches a browser.
Known limitations — stated plainly
Two things are documented as open in the product's own engineering notes, not hidden: the OTP challenge
store currently defaults to in-memory, which is correct for local development but wrong for a serverless
deployment where a verify request can land on a different instance than the one that issued the code —
a database-backed store is required before the OTP gate goes live for the due-diligence use case. And two
npm dependency advisories exist in a transitive CSS-parsing library; both are unreachable in this
application since TrustCapsule ships no CSS files and never uses dangerouslySetInnerHTML, but
the underlying dependency bump was deliberately deferred rather than rushed in before handover.
What this demonstrates
This is the reference architecture for the Data Protection Consulting and RAG Security services — specifically, that a zero-trust default (fail closed, forced RLS, immutable audit chain) can be built into a product from day one rather than retrofitted after an incident.
Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.
Discuss a Similar Architecture →Related: HarLyn Sentinel: Security Monitoring Platform · Munar Security Baseline & Handover · All proof & deliveries