Risk Register
Owner: Security. Review cadence: quarterly.
This register tracks the risks MeterBox has identified, their inherent
likelihood and impact, the controls in place, and the residual risk after
those controls. SOC 2 CC3.1 evidence; the quarterly review IS the cadence
the auditor expects.
How to read this
- Likelihood — Low / Medium / High. Annualized probability the risk
materializes, given the current operating environment.
- Impact — Low / Medium / High. The blast radius if it materializes —
customer-facing, regulatory, financial, or reputational.
- Inherent — the risk before MeterBox's controls.
- Residual — the risk after the listed mitigations are applied.
- Owner — the role accountable for the mitigation, not the person.
- Status —
active (controls applied + working), monitoring (controls
applied; effectiveness being measured), accepted (residual risk
consciously taken by CEO), retired (no longer relevant).
A risk leaving active requires a quarterly-review note explaining why.
Quarterly review log
| Review date |
Reviewer |
Material changes |
| 2026-06-04 |
Security lead |
Initial register published. |
Active risks
R-001 — Cross-tenant data leakage
| Field |
Value |
| Description |
A tenant's /v1/* request returns data belonging to a different tenant due to a bug in authentication, environment pinning, or query scoping. |
| Inherent likelihood |
Medium |
| Inherent impact |
High (regulatory + reputational) |
| Mitigations |
Single-tenant data plane pod per (org, env); no shared database; per-env environment middleware enforces X-Environment pinning; integration tests for cross-tenant queries; audit log captures every mutating call. |
| Residual likelihood |
Low |
| Residual impact |
High |
| Owner |
Engineering lead |
| Status |
active |
| Related |
InfoSec § 3, audit-trail architecture |
R-002 — Backup-mirror cryptographic-material loss
| Field |
Value |
| Description |
The tenant-supplied AES key (static mode) or the KMS access (KMS mode) becomes unavailable, making the off-cluster backup mirror unrestorable. |
| Inherent likelihood |
Medium |
| Inherent impact |
High (single-tenant data loss on a coincident in-cluster failure) |
| Mitigations |
Quarterly DR restore drill explicitly tests the decrypt path — KMS-mode Decrypt failure is the realistic failure mode. Drill failure is Sev-1. Reclaim backups + in-cluster Postgres remain as additional copies. |
| Residual likelihood |
Low |
| Residual impact |
High |
| Owner |
SRE |
| Status |
active |
| Related |
DR drill, operator runbook § 1.5 |
R-003 — Supply-chain compromise (npm package or base image)
| Field |
Value |
| Description |
A dependency or base image is compromised upstream, shipping a backdoor or info-stealer into MeterBox's production builds. |
| Inherent likelihood |
Medium |
| Inherent impact |
High |
| Mitigations |
Locked lockfile; Trivy + npm audit on every PR + nightly; SBOM published; PostgreSQL + Redis bundled (not pulled at runtime); container images private; METERBOX_RBAC_STRICT available to gate admin-key callers via the matrix even when a key leaks. |
| Residual likelihood |
Low |
| Residual impact |
High |
| Owner |
Security lead |
| Status |
active |
| Related |
InfoSec § 7, vulnerability disclosure policy, BCP scenarios § 5 |
R-004 — Compromised admin key or operator credential
| Field |
Value |
| Description |
An admin API key, owner password, or CI runner credential is exposed and used to mutate tenant configuration or read tenant data. |
| Inherent likelihood |
Medium |
| Inherent impact |
High |
| Mitigations |
MFA mandatory on owner + admin accounts; per-org METERBOX_RBAC_STRICT matrix gating headless callers; CLI --redact defaults; X-Operator-Id attribution on shared keys; rotation cadence in operator runbook § 1.5; audit log of every mutating call; security-alert outbound notifications for failed-login bursts. |
| Residual likelihood |
Low |
| Residual impact |
Medium |
| Owner |
Security lead |
| Status |
active |
| Related |
InfoSec § 5, § 8, security-alert notifications |
R-005 — Subprocessor outage or breach
| Field |
Value |
| Description |
A named subprocessor (Stripe, Auth0, Resend, a cloud hyperscaler) has an outage that blocks tenant operations, or a breach that exposes MeterBox-routed data. |
| Inherent likelihood |
Medium (outage); Low (breach) |
| Inherent impact |
High (outage of payment / identity); Medium (breach of email; depends on vendor) |
| Mitigations |
Per-vendor continuity notes in BCP/DR § 8; vendor intake gate enforces a breach-notification SLA per vendor management policy § 4; secondary email transport via email.setTransport(). |
| Residual likelihood |
Low |
| Residual impact |
Medium |
| Owner |
Security lead |
| Status |
active |
| Related |
BCP/DR § 8, vendor management policy |
R-006 — Audit-log tampering
| Field |
Value |
| Description |
An attacker with control-plane database access deletes or rewrites audit rows to cover tracks. |
| Inherent likelihood |
Low |
| Inherent impact |
High (forensic blind spot) |
| Mitigations |
Append-only API surface (no UPDATE path on cp_audit_events); SHA-256 hash chain per org; GET /cp/audit/verify walks the chain on demand; chain-break is itself an alertable signal; NDJSON export to off-host SIEM via GET /cp/audit/export. |
| Residual likelihood |
Low |
| Residual impact |
Medium (with SIEM mirror) |
| Owner |
Security lead |
| Status |
active |
| Related |
Audit trail architecture |
R-007 — Key staff unavailability
| Field |
Value |
| Description |
A staff member with critical knowledge or access is unavailable for an extended period, blocking incident response or DR drill execution. |
| Inherent likelihood |
Medium |
| Inherent impact |
Medium |
| Mitigations |
No single-person critical role per BCP § 9; on-call rotation with documented escalation; quarterly DR drill rotates a backup runner annually; password manager + emergency contact list. |
| Residual likelihood |
Low |
| Residual impact |
Medium |
| Owner |
CEO |
| Status |
active |
| Related |
BCP/DR § 9, IR plan |
R-008 — Regulatory change (GDPR, CCPA, new framework)
| Field |
Value |
| Description |
A regulator publishes guidance or a new framework that MeterBox's current processor posture or data flows do not satisfy. |
| Inherent likelihood |
Medium |
| Inherent impact |
Medium |
| Mitigations |
Annual review of InfoSec policy, privacy page, and DPAs; subprocessor list maintained as living doc; legal engaged on material changes; SOC 2 evidence map kept current. |
| Residual likelihood |
Medium |
| Residual impact |
Low |
| Owner |
Security lead |
| Status |
active |
| Related |
InfoSec policy, vendor management policy |
R-009 — Credit-grant or coupon abuse
| Field |
Value |
| Description |
A tenant or end-customer exploits the credit-grant or coupon system to consume value beyond what was actually purchased — e.g. replay attacks on grant creation, race conditions on consumption, or revocation timing. |
| Inherent likelihood |
Medium |
| Inherent impact |
Medium (per-tenant financial; not a customer-data risk) |
| Mitigations |
Idempotency keys on grant + consumption; audit log of every mutating credit operation; ledger entries are append-only; revocations issue a compensating ledger entry rather than deleting rows. |
| Residual likelihood |
Low |
| Residual impact |
Low |
| Owner |
Engineering lead |
| Status |
active |
| Related |
Audit trail architecture, data plane ledger |
R-010 — In-cluster Postgres / Redis loss before backup mirror sweep
| Field |
Value |
| Description |
In-cluster storage for a tenant's data plane is lost between the last successful backup-mirror sweep and now, exceeding the 24-hour RPO. |
| Inherent likelihood |
Low |
| Inherent impact |
High (per tenant) |
| Mitigations |
Nightly backup-mirror sweep + reclaim backups on the control-plane PV; DR drill verifies the restore path quarterly; backup-mirror-sweeper failure raises a Sev-2 that escalates to Sev-1 if sustained. |
| Residual likelihood |
Low |
| Residual impact |
Medium (data loss bounded to ≤ 24h per RPO) |
| Owner |
SRE |
| Status |
monitoring |
| Related |
BCP/DR § 5, DR drill |
Accepted risks
None recorded as of the initial review. CEO sign-off lands here when a
residual risk is consciously taken.
Retired risks
None retired yet.
Related docs