Appendix G
Security Hardening Checklist
SANKET Technical Security & Architecture Whitepaper. Public edition 2.0, 7 October 2026.
☐ Hardened, minimal host OS with Secure Boot and TPM; full-disk encryption on all volumes.
☐ SELinux or AppArmor enforcing; host firewall allowing only HTTPS and media ports inbound.
☐ Default-deny egress with explicit exceptions.
☐ Bastion-only, key-based SSH with MFA; administrator console restricted to the management network.
☐ All images pinned by digest; Edge hardening overlay applied; installation gates pass.
☐ Release public key configured; upgrades verified before load.
☐ Tenant policy: TOTP required; invitation-only or administrator-only registration; administrator device approval; member approval for groups.
☐ Security keys required for every administrator; synced passkeys refused.
☐ Device mutual TLS required; required hardware protection level and device attestation enforced on managed fleets.
☐ Minimum app versions set and enforced per platform.
☐ Classification labels defined; encrypted broadcasts used for sensitive announcements and notices only for non-sensitive content; large-group reaction counts left off.
☐ Usage analytics switched off, or locked off at provisioning, where policy requires.
☐ Tenant policy: notification previews and sender names off; download to device off; forwarding off; link previews off.
☐ App passcode required and wipe-after-failures set; screenshot blocking enabled.
☐ Vault disabled if identity keys must never leave devices.
☐ Audit export to SIEM enabled; audit chain verified on a schedule.
☐ Retention windows set to the minimum consistent with policy.
☐ Managed devices enrolled in MDM with SANKET managed configuration.
☐ Certificate pinning configured on clients.
Evaluating SANKET for your organisation?
Talk to Tosh Defence about a technical briefing, a deployment plan for your infrastructure, or the controlled edition of this whitepaper under a non-disclosure agreement.