Security is the product, not a feature. Everything we build starts from the assumption that credentials will be compromised — and we design to limit blast radius, detect compromise, and provide cryptographic proof of what happened.
Every token is cryptographically signed using Ed25519. Verification is <5ms with no database lookup required. Private keys never leave HSMs.
Every event is linked to the previous via SHA-256 hash. Tampering is mathematically detectable. Export logs for independent verification.
Tokens expire in seconds to hours, never years. A leaked token is a narrow, time-boxed exposure — not a standing key to your infrastructure.
Signature verification uses constant-time comparison to prevent timing attacks.
Team members have scoped permissions. Admin actions require re-authentication.
Content-Security-Policy headers set per endpoint. No unsigned inline scripts.
Per-agent and per-IP rate limits. Token issuance rate enforced separately.
Every webhook delivery includes an Ed25519 signature for verification.
All connections encrypted. HSTS with 1-year max-age and preload.
Maximum delegation chain depth of 3. Prevents credential sprawl.
All sessions invalidated on password reset. Token revocation cascades immediately.
If you've discovered a security issue, please report it responsibly. We respond to security reports within 24 hours and maintain a vulnerability disclosure program.
security@authrai.tech