AWS-native and IaC-only: a compliance-grade data-room stack

• Engineering
• Security

Where your most confidential documents live is not an implementation detail — it is the product. A data room is a promise about custody: that the right people see a file, the wrong people never do, and you can prove which was which years later. A promise like that cannot rest on infrastructure assembled by hand, remembered by one engineer, and impossible to reproduce. So we made a deliberate choice. Waafir is AWS-native, and every piece of it is defined as code.

Infrastructure you can read

There are two ways to stand up a cloud platform. One is to click through consoles until it works, then hope nobody changes anything. The other is to declare the entire system — networks, compute, storage, keys, edge rules — as source you can review, diff, and redeploy on demand. We do the second. The whole stack is expressed as infrastructure-as-code and applied with a single deploy.

This matters for trust in a way that is easy to underrate. A control you clicked into a console is invisible: no reviewer can audit it, no second environment can reproduce it, and a quiet change leaves no trace. A control that lives in code is a reviewable diff. When a security reviewer asks "how is data encrypted at rest?" or "what sits in front of your public edge?", the answer is a file, not a screenshot — and the same file rebuilds the environment the same way every time.

In your boundary, by design

Cloud-native is not vendor fashion here; it is what lets confidential data stay in one place. Documents live in object storage under envelope encryption with a managed key, and the storage layer refuses any write that is not encrypted under that key. The application runs as managed services — a request tier and a dedicated background tier — inside a single account. Public traffic reaches us only through a content-delivery edge fronted by a web application firewall with managed rule sets and per-IP rate limiting. Nothing about a document's life requires it to leave the account or the region it was uploaded into.

That single-boundary discipline is the quiet foundation under every other guarantee. In-account, in-region custody means there is no third-party hop to reason about and no surprise data flow to disclose.

Auditability that survives the audit

Reproducibility answers "can you rebuild it?" The audit trail answers "can you prove what happened?" Our tamper-evident audit anchors are written to object storage under write-once, read-many retention — locked for years and beyond the reach of the application that produced them. An auditor does not have to take our word that the record was not altered; the storage layer enforces it.

Reproducible, in-boundary, auditable: none of these are features you bolt on at the end. They are properties of how the system is built. For software whose entire job is to be trusted with the documents that close a deal, that is the only foundation worth standing on.