Security
We protect your data with multiple layers of security controls. Your infrastructure, your data, your control—with enterprise-grade protections that actually work.
Every layer of the platform is designed to protect your data and infrastructure.
Your data is completely isolated from other users. Each tenant gets a dedicated Durable Object with strict access controls. Comprehensive automated testing ensures cross-tenant data access is prevented.
Cloudflare Durable Objects with tenant-scoped state Every request is verified. Portal uses Auth0 JWT with JWKS signature verification. Agent communication uses HMAC-SHA256 with device-specific secrets. No implicit trust, ever.
JWT (RS256) + HMAC-SHA256 with timestamp validation App credentials and secrets are encrypted in transit using Vault Transit Engine (AES-256-GCM). Secrets are only decrypted on your infrastructure, never on our servers.
Vault Transit Engine (AES-256-GCM) with authenticated encryption Built-in defenses against SQL injection, XSS, CSRF, path traversal, and command injection. Comprehensive automated validation testing ensures input safety across all entry points.
Comprehensive input validation with Zod, output encoding, CSRF tokens HTTP-only, secure, SameSite cookies prevent session hijacking. JWT tokens verified with rotating keys (JWKS). Session timeouts and secure logout.
Signed session cookies (HS256), JWT with JWKS (30-minute cache) All external traffic encrypted with TLS 1.3 minimum. Certificate validation enforced. HSTS headers prevent downgrade attacks. No plaintext data transmission.
TLS 1.3 with perfect forward secrecy, HSTS enforcement Our infrastructure security ensures the control plane itself is secure and reliable.
All secrets stored in Vault KV v2, never in code or environment variables. AppRole authentication with least-privilege policies. Automatic secret rotation.
Vault KV v2 with AppRole auth, time-limited tokens Multiple overlapping security layers: network (Cloudflare WAF), authentication (JWT/HMAC), authorization (tenant validation), input validation, output encoding, audit logging.
7-layer security model with independent failure domains Per-tenant rate limits prevent abuse. Circuit breakers stop cascading failures. Request timeouts prevent resource exhaustion. DDoS protection via Cloudflare.
Durable Object-based rate limiting, exponential backoff All security events logged with structured data. Vault audit logs track secret access. Tenant operations logged for compliance. No sensitive data in logs.
Structured JSON logging, Vault audit backend, tenant-scoped logs Comprehensive automated security testing in CI/CD including tenant isolation tests, input validation tests, and security regression prevention. Dependency scanning keeps vulnerabilities out.
Vitest security suites, pre-commit hooks, GitHub Actions Auth0 handles portal authentication—we never see or store passwords. Agent uses HMAC signatures, not passwords. Your app data never touches our servers. Even if our platform is compromised, your data remains secure on your infrastructure.
Auth0 OIDC, HMAC-SHA256, no password storage Most self-hosting platforms leave security as an afterthought. We built it in from day one.
Get enterprise-grade security without the enterprise complexity. Join the beta waitlist to get early access.