Context Analysis

Purpose

ISO 27001 Clause 4 requires understanding the organisation and its context, the external and internal issues relevant to the ISMS. This analysis informs risk assessment, control selection, and strategic decisions.

This context analysis is centred on Maelstrom AI as the organisation, which operates two platforms under one ISMS — Provii (zero-knowledge proof age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer). External and internal factors are assessed for both platforms; where a factor is product-specific it is noted as such.

Review Frequency: Annually (in management review) or when significant changes occur

Last Updated: 2026-06-19 Next Review: 2026-11-21

External Context

Legal and Regulatory Environment

Australian Privacy Act 1988:

• Relevance. High
• Impact. Governs personal information handling
• Our Context. Minimal impact across both platforms. For Provii, the zero knowledge architecture minimises personal information collection: during credential issuance a date of birth is processed ephemerally and immediately discarded, and no names, addresses, or ID documents are collected. For downpipes, the no-custody model means Maelstrom holds no customer keys, data, or Cloudflare tokens — backups run in the customer’s own Cloudflare account under the customer’s keys, so any personal information inside a customer’s archives never reaches Maelstrom
• Monitoring. Track amendments affecting technical data (IP addresses, device identifiers)

Notifiable Data Breaches (NDB) Scheme:

• Relevance. Medium
• Impact. Requires notification if “eligible data breach” occurs
• Our Context. Low risk across both platforms. For Provii, minimal PII processing means an “eligible data breach” is unlikely; if signing keys were compromised, notification would go to relying parties (not individuals). For downpipes, the no-custody architecture means Maelstrom holds no customer data to breach; a compromise of the vendor-side control-plane or update channel would be a supply-chain matter notified to affected customers, not an individual PII breach
• Monitoring. OAIC guidance and case law

General Data Protection Regulation (GDPR):

• Relevance. Low (not operating in EU currently)
• Impact. Would apply if serving EU residents
• Our Context. If we expand internationally, GDPR compliance would be eased for Provii by the zero knowledge design and for downpipes by the no-custody model (Maelstrom is not a processor of customer data, which stays in the customer’s own Cloudflare account under the customer’s keys)
• Monitoring. Track extraterritorial applicability

Consumer Data Right (CDR) / Privacy Act Reforms:

• Relevance. Low currently
• Impact. Future reforms may expand privacy obligations
• Our Context. Proactive monitoring to ensure compliance if scope expands
• Monitoring. Australian government consultations

ISO 27001:2022 Standard:

• Relevance. High
• Impact. Defines ISMS requirements and 93 Annex A controls
• Our Context. Pursuing certification when commercially justified
• Monitoring. ISO updates, transitional guidance

Industry Standards (SLSA, NIST, OWASP):

• Relevance. High
• Impact. Best practices for supply chain security and secure development
• Our Context. Already implementing SLSA Level 3
• Monitoring. Updates to frameworks and tooling

Threat Surface

Cryptographic Attacks:

• Threat. Advances in cryptanalysis or quantum computing
• Impact. For Provii, could compromise BLS12-381 or RedJubjub. For downpipes, the threat is mitigated at rest: archives are sealed with post-quantum hybrid encryption under customer-held keys
• Our Context. Monitoring NIST post-quantum standardisation; Provii migration plan by 2030-2035, downpipes already sealing archives under post-quantum hybrid encryption
• Trend. Post-quantum algorithms maturing, but practical quantum threat still distant

Supply Chain Attacks (e.g., npm, cargo platform):

• Threat. Malicious dependencies, typosquatting, compromised build tools; for downpipes, a compromised engine update is a supply-chain path into customers’ own Cloudflare accounts
• Impact. Could inject vulnerabilities or backdoors into our code, or ship a tampered engine update to customer tenants
• Our Context. SLSA Level 3 mitigates this (hermetic builds, signed provenance). For downpipes, the update channel is static and signature-pinned (updates.downpipes.io): the engine verifies the signature against a pinned public key before applying and pulls (never receives a push), and the downpipes Update Signer private key is held offline by the operator and never deployed to any Worker
• Trend. Increasing frequency (SolarWinds, Log4Shell, etc.)
• Monitoring. GitHub security advisories, Dependabot alerts

Phishing and Social Engineering:

• Threat. Attackers targeting team members to gain access
• Impact. Could lead to credential theft or malicious code commits
• Our Context. MFA and security awareness training reduce risk
• Trend. Sophisticated, machine-generated phishing increasing

DDoS Attacks on Verifier API (Provii):

• Threat. Overload the Provii Verifier API to deny service
• Impact. Relying parties unable to verify proofs
• Our Context. Cloudflare provides DDoS protection (mitigates most attacks)
• Trend. DDoS-for-hire services readily available

Signing Key Theft (Provii):

• Threat. Adversary gains access to Provii production signing keys
• Impact. Could issue fraudulent credentials (catastrophic)
• Our Context. Highest Provii risk. Keys stored in Cloudflare KV with restricted access
• Mitigation. Key rotation, audit logging, minimal access

downpipes Control-Plane Signer or Update-Channel Compromise:

• Threat. Adversary forges licences via the downpipes Licence Signer, or ships a malicious engine update via the update channel
• Impact. A tampered update could in principle reach customers’ own Cloudflare accounts; a forged licence never gates backup or restore (fail-open, degrades to free tier)
• Our Context. No-custody control-plane holds no customer keys, data, or Cloudflare tokens. Licence Signer key in Cloudflare Secrets Store (fail-open); Update Signer key held offline, never deployed to any Worker
• Mitigation. Signature-pinned, pull-only update channel; offline update signer; fail-open licensing

Zero-Day Vulnerabilities in Dependencies:

• Threat. Undisclosed vulnerabilities in Rust, TypeScript, or cryptographic libraries
• Impact. Could compromise cryptographic operations or expose data
• Our Context. Monitoring CVEs, patching rapidly, fuzzing for unknown bugs

Market and Competitive Surface

Age Verification Market (Provii):

• Trend. Growing demand due to online safety regulations (Australia, UK, EU considering age verification laws)
• Opportunity. Privacy-preserving solutions (like Provii) increasingly attractive
• Competition. Traditional age verification (ID checks) vs. privacy-preserving methods

Backup & Disaster-Recovery Market (downpipes):

• Trend. Growing reliance on the Cloudflare data layer (Workers KV, D1, R2, Secrets Store) without mature, independent backup tooling
• Opportunity. A no-custody model — backups running in the customer’s own Cloudflare account under the customer’s keys — differentiates downpipes from custodial third-party backup services
• Competition. Custodial managed-backup providers vs. the no-custody, in-tenant approach

Privacy Expectations:

• Trend. Increasing user awareness of privacy risks
• Opportunity. Zero knowledge approach aligns with privacy expectations
• Risk. If zero knowledge becomes standard, no longer a differentiator

Transparency Movement:

• Trend. Open-source and transparency valued in security products
• Opportunity. Our fully public ISMS builds trust. Provii is open source under a per-repo mix (AGPL-3.0-only, Apache-2.0, MIT, with some proprietary). downpipes uses a deliberate split: the engine, console, and control-plane are source-available under the Elastic License v2 (auditable but not resellable as a managed service, which would defeat no-custody), while the offline reader is MIT open source
• Risk. Transparency also exposes implementation details to adversaries (managed through security by design, not obscurity)

Competitor Security Incidents:

• Monitoring. Public disclosures of breaches in the identity/age verification space and in the backup/disaster-recovery space
• Learning. Understand attack vectors to strengthen our defences across both platforms

Technology Trends

Edge Computing (Cloudflare Workers):

• Trend. Increasing adoption for low-latency, scalable services
• Opportunity. Aligns with both platforms — Provii runs as Cloudflare Workers, and the downpipes engine and console run as routeless in-tenant Workers in the customer’s own account
• Risk. Dependency on Cloudflare availability. For downpipes, growing reliance on the Cloudflare data layer is also the market need the product addresses

Zero knowledge Proof Innovation:

• Trend. ZKP tooling improving (faster proving, smaller proofs)
• Opportunity. Stay current with libraries (bellman, arkworks) for performance gains
• Risk. Cryptographic assumptions may evolve; need to track research

Post-Quantum Cryptography:

• Trend. NIST standardisation finalised August 2024 (ML-KEM, ML-DSA)
• Timeline. Practical quantum threat estimated 2030-2035
• Action. For Provii, monitor and plan migration (not urgent yet). For downpipes, archives are already sealed with post-quantum hybrid encryption under customer-held keys

WebAssembly and Mobile SDKs:

• Trend. Cross-platform development simplifying (UniFFI for Rust → Swift/Kotlin)
• Opportunity. Expand platform support efficiently
• Risk. New attack surfaces (mobile malware, browser extensions)

Economic and Financial Factors

Funding and Budget:

• Context. Small, bootstrapped organisation
• Impact. Security budget limited; prioritise cost-effective controls (open source tools, cloud-managed security)
• Risk. May defer expensive certifications or external audits until revenue supports

Cloudflare and GitHub Pricing:

• Context. Currently within free/low tiers
• Impact. Cost increases if usage scales
• Opportunity. Cloudflare/GitHub offer startup programmes if needed

Insurance (Cyber Liability):

• Context. Not currently held
• Impact. Potential future consideration if handling sensitive data or large-scale deployments
• Trend. Insurers requiring stronger security posture (ISO 27001 helps)

Internal Context

Organisational Structure

Small, Fully Remote Team:

• Characteristics. Lean, high autonomy, distributed geographically
• Benefits. Agility, focus, low overhead
• Challenges. Limited redundancy (single points of failure), work-life boundaries, communication overhead

Roles:

• ISMS Owner
• Security Lead
• Developer(s)

Decision-Making: Flat structure, rapid decision-making, direct communication

Culture and Values

Transparency:

• Value. Radical transparency in security practices
• Manifestation. Public ISMS documentation, open source code, public incident postmortems
• Impact on ISMS. All policies and procedures documented publicly (no “security through obscurity”)

Privacy-First / No-Custody:

• Value. User and customer privacy paramount; minimise what Maelstrom holds
• Manifestation. For Provii, zero knowledge architecture and minimal PII processing (DOB processed ephemerally during issuance only). For downpipes, a no-custody model — Maelstrom holds no customer keys, data, or Cloudflare tokens, and keeps no standing inbound path (“runs dark”)
• Impact on ISMS. Simplified data protection requirements across both platforms, but cryptographic controls critical

Technical Excellence:

• Value. High-quality, well-tested code
• Manifestation. testing (unit, integration, fuzz), code review, CI/CD automation
• Impact on ISMS. Strong secure development lifecycle

Continuous Improvement:

• Value. Iterative refinement
• Manifestation. Regular retrospectives, internal audits, metric-driven improvements
• Impact on ISMS. ISMS not static, evolves based on learnings

Information Assets

Cryptographic Keys (Highest Criticality):

• Provii. RedJubjub signing keys (production and development); HMAC secrets for API authentication
• downpipes (vendor-side). downpipes Update Signer (held offline by the operator, never deployed to any Worker) and downpipes Licence Signer (Cloudflare Secrets Store, control-plane, fail-open)
• Impact. For Provii, compromise = catastrophic (fraudulent credentials). For downpipes, compromise of the Update Signer would be a supply-chain path into customer tenants; the Licence Signer is fail-open and never gates backup or restore
• Note. downpipes customer encryption keys (break-glass, operational, archive-signer) are customer-held and never reach Maelstrom (no-custody), so they are not Maelstrom assets

Source Code:

• Provii (public): provii-crypto, provii-verifier, provii-issuer, SDKs
• downpipes (source-available ELv2): engine, console, control-plane. Offline reader (downpipe) is MIT open source
• Impact. Tampering could introduce vulnerabilities

Infrastructure Access (Cloudflare, GitHub):

• API tokens, account credentials (including the downpipes vendor-side control-plane and update-channel accounts)
• Impact. Unauthorised access could disrupt service or compromise keys

Documentation (Public):

• ISMS, API docs, technical architecture
• Impact. Inaccurate documentation could lead to misuse

Operational Data (Logs, Analytics):

• IP addresses (90 days retention). Standard audit log entries are retained for 90 days. Critical security events (such as detected attacks, replay attempts, and IP blocks) are retained for up to 365 days to support security investigation.
• Audit logs (standard retention: 90 days; critical security event logs retained for up to 365 days)
• Impact. Privacy risk if improperly disclosed

Technology Stack

Languages:

• Rust (Provii cryptography, backend)
• TypeScript/JavaScript (SDKs, frontend, downpipes engine/console)
• Swift/Kotlin (Provii mobile via UniFFI)
• Go (downpipes offline reader, alongside TypeScript)

Infrastructure:

• Cloudflare Workers (serverless edge compute; Provii services, and the downpipes engine/console as routeless in-tenant Workers in the customer’s own account)
• Cloudflare KV (key-value storage)
• Cloudflare Durable Objects (stateful edge)
• Cloudflare R2 (downpipes backup destinations and the signature-pinned update channel, updates.downpipes.io)
• downpipes vendor-side control-plane (licence tokens and a content-free advisory beacon; holds no customer keys, data, or Cloudflare tokens)
• GitHub (source control, CI/CD)

Dependencies:

• bellman, bls12_381, redjubjub (Provii cryptography)
• wasm-bindgen (WebAssembly)
• Extensive npm and cargo dependencies

Implications:

• Dependency on Cloudflare and GitHub (supplier risk)
• Supply chain security critical (SLSA Level 3); the downpipes update channel is signature-pinned and pull-only
• Cryptographic library quality paramount

Processes

Development:

• Git-based workflow (pull requests, code review)
• Automated testing and security scanning (CI/CD)
• Continuous deployment (via GitHub Actions + wrangler)

Risk Management:

• Quarterly risk assessments
• Risk register maintained

Incident Response:

• Defined process (Detect → Assess → Contain → Eradicate → Recover → Learn)
• Contact: security@maelstrom.au

Change Management:

• Standard changes (automated via CI/CD)
• Normal changes (require approval)
• Emergency changes (immediate, with post-implementation review)

Resource Constraints

Staffing:

• Constraint. Small team = limited capacity
• Impact. Must prioritise highest-value security activities; automation essential
• Mitigation. Lean processes, cloud-managed security (Cloudflare DDoS, GitHub security scanning)

Budget:

• Constraint. Limited budget for security tools and external audits
• Impact. Prioritise open source tools, defer expensive certifications until ready
• Mitigation. ISO 27001 certification pursued when commercially justified

Time:

• Constraint. Security competes with feature development
• Impact. Must integrate security into development (shift-left)
• Mitigation. Automated security (CI/CD scanning), security as requirement (not afterthought)

Interested Parties

Provii Customers / Relying Parties

Who: Websites and apps using Provii for age verification

Needs and Expectations:

• Reliable age verification (uptime, performance)
• Secure proof verification (no fraudulent proofs accepted)
• Privacy-preserving (no user PII exposed to relying party or Maelstrom AI)
• Transparent security practices (ISMS documentation)
• Responsive support (incident communication, API changes)

How we address:

• Cloudflare edge network with global redundancy (best-effort availability; no contractual SLA at current tier)
• Rigorous testing and code review
• Public ISMS and incident postmortems
• Public API documentation and changelog

downpipes Customers

Who: Organisations self-hosting downpipes in their own Cloudflare account to back up the Cloudflare data layer (Workers KV, D1, R2, Secrets Store, and zone/account configuration)

Needs and Expectations:

• No-custody assurance (Maelstrom holds no customer keys, data, or Cloudflare tokens)
• Proven recoverability (verified backups; restore that works)
• Trustworthy updates (engine updates that haven’t been tampered with)
• Control and autonomy (backups run under the customer’s own keys, with no standing vendor access)
• Responsive enterprise support when engaged

How we address:

• No-custody, in-tenant architecture: the engine and console run in the customer’s own Cloudflare account under the customer’s keys
• 3-2-1 fan-out to 2+ customer-controlled destinations; hourly canary integrity flights; an MIT-licensed offline reader that restores from archive bytes plus the customer’s offline key alone, with no vendor and no network
• Signature-pinned, pull-only update channel verified against a pinned public key before applying (canary-gated safe-apply with automatic rollback)
• Consent diagnostics only: redaction-safe signed support bundles and owner-minted, time-boxed, scoped, immediately-revocable read-only pull credentials — no standing vendor access

Provii End Users (Individuals Proving Age)

Who: Individuals using wallets to generate and present age proofs

Needs and Expectations:

• Privacy (no PII shared with anyone)
• Security (wallet credentials not stolen or misused)
• Usability (wallet app easy to use)
• Transparency (understand how their data is protected, or not collected)

How we address:

• Zero knowledge proofs (no PII in proofs)
• Wallet SDK security (open source, auditable)
• Public documentation (Privacy Policy, FAQs)

Team Members

Needs and Expectations:

• Clear security policies and procedures
• Usable security tools (not onerous)
• Support when security questions arise
• Training to understand responsibilities

How we address:

• Public, searchable ISMS documentation
• MFA, password managers (standard tools)
• Security Lead available for consultation
• Onboarding and annual training

Suppliers (Cloudflare, GitHub)

Needs and Expectations:

• Compliance with terms of service
• Responsible use of services
• Timely payment

How we address:

• Follow Cloudflare/GitHub terms
• Security best practices (don’t abuse services)
• Maintain accounts in good standing

Regulators (OAIC, Future Auditors)

Needs and Expectations:

• Compliance with Privacy Act
• (Future) Compliance with ISO 27001:2022
• Evidence of security controls
• Incident notification if required

How we address:

• Zero-knowledge architecture is designed to support privacy compliance
• ISMS implementation per ISO 27001
• Evidence collection and retention
• Incident response procedure includes notification requirements

Community (Open-Source, Privacy Advocates)

Needs and Expectations:

• Transparency in security and privacy practices
• Open-source code (auditable)
• Ethical use of technology (no surveillance)

How we address:

• Fully public ISMS documentation
• Provii repositories open source under a per-repo mix (GitHub); downpipes is source-available (Elastic License v2) for the engine, console, and control-plane, with the offline reader MIT open source
• Privacy-by-design and no-custody architectures

Strategic Direction

Mission

Build privacy-preserving and data-resilience technology that minimises what Maelstrom holds: Provii verifies age without collecting personal information, and downpipes provides no-custody backup & disaster recovery for the Cloudflare data layer under the customer’s own keys.

Vision (3-5 years)

• ISO 27001 certification pursued when commercially justified
• Widely adopted — Provii by relying parties valuing privacy, and downpipes by organisations needing no-custody Cloudflare resilience
• Proven security (no major incidents, successful audits)
• Thought leadership in zero knowledge applications and no-custody backup architecture

Objectives (Security-Related)

1. Achieve ISO 27001 certification when commercially justified (covering both platforms)
2. Maintain zero major incidents (P0/P1) through 2026
3. Scale securely to support increasing Provii relying parties and downpipes customers
4. Build trust through transparency and public documentation
5. Continuous improvement of ISMS and security posture

Implications for ISMS

Opportunities

• Zero-knowledge architecture (Provii) and the no-custody model (downpipes) are both designed to minimise what Maelstrom holds, simplifying data protection and supporting privacy compliance
• Cloud-native infrastructure enables scalable security (Cloudflare DDoS, edge compute)
• Open and auditable code allows community review and builds trust (Provii open source; downpipes source-available under ELv2, with an MIT offline reader)
• Small team enables agility and rapid security improvements

Challenges

• Resource constraints require prioritisation and automation
• Cryptographic complexity demands expertise and rigorous testing (Provii ZK proofs; downpipes post-quantum hybrid sealing)
• Supply chain risks require SLSA Level 3 and dependency vigilance, plus a signature-pinned, pull-only downpipes update channel and an offline update signer
• Single points of failure (small team, Cloudflare dependency) require business continuity planning; Maelstrom’s entire Cloudflare estate is backed up by our own production instance of downpipes (we run downpipes as a customer of our own product)

ISMS Priorities

1. Cryptographic key protection (highest risk)
2. Supply chain security (SLSA Level 3 maintained)
3. Incident response readiness (rapid detection and response)
4. Continuous monitoring (vulnerabilities, supplier status, threat surface)
5. ISO 27001 certification (structured approach, external validation)

Related Documents

• ISMS Scope - Boundaries of ISMS
• Risk Register - Risks informed by this context
• Management Review - Context reviewed annually
• Information Security Policy - Objectives aligned with context

Document Information