Federal Compliance Documentation
NIST SP 800-53 control mapping, HIPAA safeguard attestation, and Knox Blockchain architecture documentation for federal procurement review.
Bonis Systems LLC • UEI: R2BPJDC5CBA3 • CAGE: 1TSP2 • NAICS: 541511
Knox Blockchain Architecture
PHASE 1 — DEPLOYED
Local Chain
SHA-256 linked blocks on PostgreSQL + Redis. Taxonomy of 100+ event types across the Bonis portfolio. Immutable audit trail with federal trace IDs. Block proof verification.
PHASE 2 — READY
Google Blockchain Node Engine
Permissioned nodes on Google Cloud. Multi-party consensus for cross-agency verification. FedRAMP-inherited controls.
PHASE 3 — PLANNED
Hyperledger Fabric
Multi-organization consensus network. Smart contracts for automated compliance. Cross-platform interoperability.
Block Structure
{
"index": 1,
"timestamp": "2026-04-11T10:00:00.000Z",
"type": "ORDER_RECEIPT | LICENSE_VERIFY | COA_VERIFY | FEDERAL_AUDIT | ...",
"data": { "orderId": "...", "vendorId": "...", "buyerId": "..." },
"previousHash": "a3f2b8c1d4e5f6...",
"hash": "SHA-256(index + timestamp + type + data + previousHash)",
"federalTraceId": "UUID — submitted to federal ledger"
}NIST SP 800-53 Control Mapping
24 of 26 controls fully implemented
NextAuth JWT with role-based access (Admin/Vendor/Buyer). 24-hour session timeout. Account disable capability.
Server-side session verification on all API routes. Admin/Vendor role checks. API key scoped permissions.
Rate limiting: 10 auth attempts per minute per IP. Security PIN lockout after failed attempts.
Terms of Service acceptance required. Regulatory notice banner on all pages.
Knox audit trail: 15 action types, 14 entity types. Immutable Redis sorted sets with 1-year retention.
Each record: userId, action, entity, entityId, before/after diffs, hashed IP, user-agent, timestamp.
Admin-only /api/audit endpoint with pagination. Real-time pub/sub for monitoring.
Knox Blockchain immutable ledger. SHA-256 hash chain prevents tampering. No update/delete on audit records.
Knox Blockchain block proofs with cryptographic verification. Federal trace IDs on all transactions.
Health endpoint (/api/health) monitors DB connectivity, uptime. Knox middleware logs all requests.
poweredByHeader disabled. No debug endpoints in production. Bot/probe blocking in middleware.
Email/password with bcrypt hashing. JWT tokens. Security PIN/passphrase as secondary factor.
bcrypt password hashing. SHA-256 for PINs/API keys. httpOnly secure cookies.
Knox audit logging captures security events. Automated rate limiting and bot blocking. Formal IR plan pending.
No local data storage. Cloud-based (Cloud Run stateless). Database credentials via environment variables only.
Fully cloud-hosted on Google Cloud Run. No physical infrastructure required.
Dependency auditing via npm. CI/CD security scanning. Formal pen test pending.
CSP headers, CORS restrictions, rate limiting, bot detection, probe blocking.
TLS 1.3 enforced. HSTS with preload. All API traffic encrypted.
SHA-256 for blockchain/API keys. bcrypt for passwords. Keys in environment variables, never in code.
SHA-256 blockchain integrity. TLS 1.3. bcrypt password hashing. End-to-end encryption on sensitive data.
Database encryption via Cloud SQL/Railway TLS. No plaintext credentials stored. API keys SHA-256 hashed.
CI/CD pipeline with automated builds. npm audit on every push. GitHub Actions security scanning.
Input sanitization (sanitize-html). Zod schema validation. CSP prevents script injection.
Knox middleware request logging. Health endpoint. Rate limit monitoring. Audit trail pub/sub.
Zod schemas on all API endpoints. sanitize-html for user content. SQL injection proof via Prisma ORM.
HIPAA Security Rule Safeguards
BAA-ready attestation for Business Associate Agreement execution
Knox Blockchain audit trail, risk-based access controls, security incident logging
Platform-level security managed by Bonis Systems LLC engineering team
Role-based access: Admin, Vendor, Buyer. Principle of least privilege on all API routes
JWT session tokens, API key scoping, admin-only endpoints, vendor isolation
Documentation and training materials under development
Cloud Run auto-scaling and failover. Formal DR plan under development
Internal security audits completed. Third-party audit pending
Fully cloud-hosted on Google Cloud Platform. GCP maintains SOC 2/ISO 27001 for facilities
No on-premise servers. Cloud Run containers are stateless and ephemeral
Unique user IDs, JWT authentication, auto-logout (24hr), role-based permissions
Knox Blockchain immutable audit trail. 15 action types, 1-year retention, tamper-proof
SHA-256 blockchain hash verification. Zod input validation. Prisma ORM (no SQL injection)
TLS 1.3 enforced. HSTS preload. End-to-end encryption. No plaintext data transmission
Knox Platform Products
HealthAgentCare.com
AI Healthcare Companion
AI-powered health companion for Medicare, Medicaid, and VA beneficiaries. End-to-end encryption. Knox Blockchain patient data ownership.
TerraVaultHQ.com
B2B Hemp & Cannabis Marketplace
Compliant wholesale marketplace surface with license/COA verification, seed-to-sale tracking, and vendor-direct settlement. Medical supply chain capabilities.
DealMatcherApp.com
AI Deal Matching Platform
Bruce AI agent scans markets daily for business/real estate deals. Smart-contract NDAs and procurement matchmaking. Counterparties settle directly off-platform.
Federal Procurement Inquiries
Knox Blockchain v1.0 • Bonis Systems LLC • UEI: R2BPJDC5CBA3 • CAGE: 1TSP2 • NAICS: 541511