Security

Security

Isolation is the headline. Underneath sits a hardened control plane and an enforced runtime—so policy is something you prove, not something you hope holds.

Maps cleanly to the frameworks your auditors already use

HIPAASOXPCI-DSSGDPRISO 27001SOC 2

Security by Design

Defense-in-depth, all the way down

Isolation is the headline. Underneath it sits a hardened control plane and an enforced runtime—so policy is something you prove, not something you hope holds.

✓

Forced proxy egressFirewall rules block direct HTTP/HTTPS so every request flows through the enforced proxy path—bypass routes are closed, not just discouraged.

✓

mTLS device bindingBind sessions to approved devices with mutual-TLS certificates. Stolen credentials alone can't open a session.

✓

Anti-replay integrityEvery API request is signed with timestamp + nonce + HMAC, with nonce uniqueness tracked in a distributed cache.

✓

Hardened tokensJWTs carry IP-binding and expiry checks with server-side revocation and blacklisting for instant cut-off.

✓

Admin 2FA & lockoutTOTP two-factor, per-user and per-IP account lockout, and device fingerprinting protect the system-admin plane.

✓

Tenant crypto isolationPer-tenant keys, encrypted config chains, and strict CSP/HSTS security headers keep tenants cryptographically separated.

Control Plane

The API and session plane, locked down

CSRF protectionPre-login CSRF tokens for session init; post-login tokens bound to user session state.

Anti-replay integrityTimestamp + nonce + HMAC signatures with nonce uniqueness tracked in a distributed cache.

JWT hardeningIP-binding and expiry checks with server-side revocation and token blacklisting.

Distributed rate limitingRedis-backed sliding-window limits across APIs, with dedicated per-tenant AI caps.

Admin auth hardeningTOTP 2FA, per-user and per-IP lockout, and device fingerprinting on the sys-admin plane.

Strict security headersCSP, HSTS on production builds, clickjacking/XSS hardening, and server-identifier stripping.

Runtime

Where enforcement actually happens

Forced proxy egressFirewall rules block direct HTTP/HTTPS so the browser must traverse the proxy path—bypass routes are closed.

Domain allow / denyProxy config enforces allowlists and denylists, and the runtime emits domain telemetry for governance.

Scanned file boundaryThe only way a file crosses the isolation boundary is through the ClamAV pipeline with explicit policy enablement.

mTLS device bindingSessions bind to approved devices via mutual TLS—stolen credentials alone cannot open a session.

Multi-tenant, cryptographically isolated

Each tenant gets its own keys and a secure session-initialization chain. Configuration is encrypted at rest and decrypted only through the tenant's encryption chain. AI provider keys never live in plaintext. Tenants are separated by domain/subdomain routing with independent policy, branding, and billing.

AI Assistant

Understand any page—without leaking it

An optional, tenant-gated assistant works from a screenshot of the current view—never your raw browsing history. Summarize a dense report, translate a foreign portal, explain an error, or extract a table in one click.

SummarizeExplainTranslateExtractKey PointsNext StepsCompareTroubleshoot

Tenant-gatedRate-limited per minute & dayScreenshot-scopedKeys encrypted at restProvider-flexible

youSummarize this incident report

AI3 systems affected · root cause: expired cert · MTTR 42m

youTranslate the vendor portal

AIRendered in English — 14 fields mapped

Stop securing endpoints.
Start isolating browsers.

30-day free pilot · 25–50 users · Architecture review included · No credit card required