Skip to main content

Security Model

DoubleDino runs inside your infrastructure and your existing security boundary.

It does not require production data to leave your environment.

DoubleDino connects to your configured source, transforms sensitive values, and returns safe data for debugging.

Deployment boundary​

DoubleDino is deployed and managed by your organisation.

Your organisation controls:

  • Where DoubleDino runs.
  • Network access.
  • Source permissions.
  • User access.
  • Infrastructure security.

DoubleDino does not operate as an external service.

Data flow​

The data flow is:

Transformation happens inside the DoubleDino process before data is returned.

Original production values are not returned to developers.

Source access​

DoubleDino requires access to the configured source:

  • Database.
  • Redis instance.
  • Log file.

Access is controlled using your existing infrastructure permissions and connection configuration.

Proxy mode​

Proxy mode is read-only.

DoubleDino:

  • Does not modify source data.
  • Does not write back to databases.
  • Does not alter log files.

Queries are executed against the connected source, then transformed before the response is returned.

Clone mode​

Clone mode creates a transformed copy of source data.

The destination contains transformed values while preserving:

  • Relationships.
  • Data structure.
  • Data types.

The original source remains unchanged.

Data transformation​

DoubleDino transforms sensitive values before they leave the process.

It preserves:

  • Relationships.
  • Data structure.
  • JSON structure.
  • Application debugging workflows.

See:

Data Transformation

Authentication​

Proxy requests require:

x-api-key: your-api-key

Administrators control API key distribution and access.

Secret key​

The transformation key:

DD_SECRET_KEY

controls deterministic transformation.

The same secret key produces the same transformed values.

Changing the key creates a different transformed dataset.

Protect this value like any other sensitive infrastructure secret.

Logging​

DoubleDino writes logs through standard output and error streams.

Your organisation controls:

  • Log collection.
  • Storage.
  • Retention.
  • Access.

Responsibility boundary​

DoubleDino operates within your existing infrastructure.

Your organisation remains responsible for:

  • Infrastructure security.
  • Network controls.
  • Source system permissions.
  • Developer access policies.

DoubleDino provides the transformation layer that allows teams to debug systems while reducing exposure of original production data.