# Adversary Worksheet — fill in for your deployment

> Use this with `architecture-and-threat-model.md` open. The kit's threat model is generic; this worksheet adapts it to your environment.
> Free for any internal use, no attribution required.

## 1. Your tenant boundary

**Q1.1** Is your data partitioned per tenant in the database, or do you rely on application-level filtering?
- [ ] Database-level (RLS, schema-per-tenant, separate DBs)
- [ ] Application-level only
- [ ] Mixed
- [ ] Don't know

**Q1.2** If application-level: list the queries that touch tenant-shared tables. Each is a potential cross-tenant bleed point.

| File / function | Table | Filter pattern | Reviewed? |
| --- | --- | --- | --- |
| | | | |
| | | | |

**Q1.3** Cross-tenant bleed test — last performed when?  __________ Date / commit __________

---

## 2. Key custody

**Q2.1** Where does your master KEK live?
- [ ] AWS KMS / GCP KMS / Azure Key Vault
- [ ] HSM (named: ___________ )
- [ ] Software-derived from secret in vault
- [ ] Don't know

**Q2.2** Who can rotate the KEK without dual-control?  __________

**Q2.3** What happens to historical ciphertext on KEK rotation?
- [ ] Re-wrapped automatically
- [ ] Old KEK retained for unwrap, new KEK for new writes
- [ ] Old data manually re-encrypted
- [ ] Don't know

---

## 3. Audit trail integrity

**Q3.1** Are your audit logs append-only at the database layer (not just the application)?
- [ ] Yes (specify mechanism: _______ )
- [ ] No
- [ ] Don't know

**Q3.2** If an attacker has DBA access, can they edit history undetected?
- [ ] No (chain HMAC, blockchain, immutable WAL)
- [ ] Detectable but not prevented
- [ ] Yes
- [ ] Don't know

**Q3.3** How long do you retain audit events?  ____________

**Q3.4** Have you tested log restoration from backup in the last 12 months?  ____________

---

## 4. Endpoint compromise

**Q4.1** If a single user's laptop is fully compromised, what data can be exfiltrated?
- [ ] Only that user's data (per-device key isolation)
- [ ] Their team's data
- [ ] All tenant data
- [ ] Cross-tenant data

**Q4.2** What is the time-to-revoke for a compromised device?  ____________

**Q4.3** Is the revocation event itself in the chain (so it cannot be silently undone)?
- [ ] Yes
- [ ] No
- [ ] Don't know

---

## 5. Network attack

**Q5.1** Is mTLS in use for client→server?
- [ ] Yes, for all tenants
- [ ] Yes, optional for enterprise tenants
- [ ] TLS 1.3 only
- [ ] Older TLS versions still accepted

**Q5.2** Is request signing layered on top of TLS for high-value operations?
- [ ] Yes
- [ ] No

---

## 6. State-level / legal compulsion

**Q6.1** If a government order is served, what data could be handed over?
- [ ] Plaintext content
- [ ] Ciphertext only (no keys to decrypt)
- [ ] Metadata only (no content of any form)
- [ ] Nothing — keys are customer-controlled, no data at vendor

**Q6.2** Where is the data physically stored, region by region?

| Region | Provider | Encryption-at-rest? | Backups in region? |
| --- | --- | --- | --- |
| | | | |
| | | | |

---

## 7. Quantum

**Q7.1** What's your timeline for migrating asymmetric primitives to PQC?
- [ ] Already done
- [ ] In progress, ETA: _______
- [ ] Tracked, no commitment
- [ ] Not on radar

**Q7.2** Is your symmetric encryption AES-256 (post-quantum-acceptable) or AES-128 (marginal)?  __________

---

## 8. Dispute resolution

**Q8.1** If a customer claims they did not perform action X, how do you prove they did?
- [ ] Cryptographic receipt (signature chain)
- [ ] Application audit log (SQL row)
- [ ] Best-effort log files
- [ ] Don't have a process

**Q8.2** Can the customer independently verify the proof without trusting your system?
- [ ] Yes, via public verification endpoint
- [ ] Yes, by exporting and recomputing locally
- [ ] No

---

## 9. Score

Count of checked boxes that indicate "robust" posture (top option in each Q): _____ / out of 22.

If the count is below 14, the room for cryptographic-control-plane improvement is large. NoData covers Q1.1 (DB-level), Q3.1-Q3.2 (chain HMAC), Q4.1-Q4.3 (per-device keys + chain revocation), Q6.1 (metadata only), Q8.1-Q8.2 (independently verifiable proof).

If the count is 14+, you have most pieces — see `open-vs-closed.md` for what NoData adds at the boundary.

---

*This worksheet is part of the NoData Technical Kit. Free, no attribution required. Email security@nodatacapsule.com for follow-up.*