ACE Reports ingestion architecture and tenant isolation
A technical overview of how the MyCustomsInfo® platform ingests, isolates and protects CBP ACE Reports data for each US tenant. Written for in-house security, compliance and architecture teams evaluating the platform for their workspace.
Figure 1: Two ingestion paths into the MyCustomsInfo® Platform
The ingestion model
Every US tenant receives a unique ingestion identifier on contract execution. CBP ACE Reports (ES-001, ES-002 and ES-003) are delivered into the platform either through scheduled CSV email from your ACE Portal account, or through a broker-to-platform channel operated by Trade-IQ LLC under limited Power of Attorney. Both paths terminate in your tenant-specific S3 raw zone, encrypted at rest, before passing through schema validation and into the audit data model.
Built for enterprise-grade tenant isolation
AWS KMS Customer Managed Keys
Each tenant’s S3 raw zone, Aurora schema and document store are encrypted at rest under a tenant-specific KMS Customer Managed Key. Cross-tenant decryption is mathematically impossible by design.
Schema-per-tenant separation
Each tenant has a dedicated PostgreSQL schema. Application code sets the active tenant context from validated JWT claims on every connection. Tenant IDs from request parameters are never used.
Row Level Security
Every table carries RLS policies enforced at the database engine, not at the application layer. Even a compromised application credential cannot read another tenant’s rows.
No human inbox access
The tenant ingestion mailbox is a closed automated pipeline through AWS SES inbound. No human mailbox client connects to it. Attachments are extracted, validated and landed in the tenant raw zone without operator intervention.
Schema validation at ingest
Incoming ES-001, ES-002 and ES-003 files are validated against the current CBP schema definition. New or missing columns raise a non-blocking alert rather than silently dropping data, so CBP schema updates are caught immediately.
Freshness monitoring
The platform monitors the expected arrival window for each tenant’s scheduled delivery. A missed run raises an alert within 24 hours of the expected window, triggering a joint check of the schedule configuration.
The technology stack
| Ingestion gateway | AWS SES inbound, tenant-keyed routing, WAF protected |
| Raw zone | AWS S3 with tenant-specific prefix and KMS CMK encryption |
| Processing | AWS Glue with Apache Iceberg tables for the lakehouse layer |
| Relational store | AWS Aurora PostgreSQL, schema-per-tenant, Row Level Security enforced |
| Identity | AWS Cognito with OAuth 2.0, OIDC, MFA enforced for admin roles, RS256 JWT |
| Audit trail | AWS CloudTrail with WORM storage, queryable through Athena |
| Secrets | AWS Secrets Manager, no plaintext credentials in code or configuration |
| Security tooling | AWS WAF (OWASP Core Rule Set), GuardDuty, Security Hub, AWS Config drift detection |
Broker-agnostic by design
MyCustomsInfo® does not file entries, post-summary corrections or protests on behalf of any tenant. The platform observes, reconciles and surfaces. The licensed party in any filing chain is the tenant’s own customs broker, or Trade-IQ LLC where Trade-IQ is engaged as the filing party under separate Power of Attorney. This separation is required by 19 U.S.C. §1641 and is a deliberate architectural choice. It means your existing broker relationship is preserved, the licensed filer is always clearly identified, and the platform sits cleanly outside customs business scope.
Engagement sequencing
The tenant ingestion address is issued only after mutual NDA, Data Processing Agreement and Engagement Letter are executed. The address pattern is unique to your engagement and is not published. This sequencing is a security control, not an administrative delay.
Certification and assurance roadmap
ISO 27001:2022 certification is on track for Q4 2026, with all 93 Annex A controls mapped and either implemented or scheduled. Annual external penetration testing follows the OWASP Testing Guide v4.2, performed by a CREST-certified provider. Automated DAST runs on every staging deployment. Critical vulnerabilities are remediated within 24 hours, high within 7 days and medium within 30 days under platform SLA.
Request a technical architecture call
For in-house customs, security and architecture teams evaluating MyCustomsInfo® as a tenant-isolated ACE Reports platform, we offer a 45-minute architecture deep-dive call covering the ingestion model, the tenancy model, the security controls and the certification roadmap.
Request the architecture call