Security

Security architecture

Identity and access

Passwordless authentication, passkeys (WebAuthn), TOTP; sensitive operations require MFA.
RBAC + ABAC through the policy engine, purpose-bound authorization, tenant isolation on every query.
Machine identities for API keys, OAuth clients, automations and AI agents — nothing runs as “system admin”.

Envelope encryption with a data key per tenant and domain (identity, document, biometric, credential, security, storage); rotation and revocation per domain; BYOK/HYOK on Enterprise and Sovereign.
Biometric templates isolated under a dedicated key; raw material discarded per retention policy.
Binary artefacts in object storage with SHA-256 integrity; PostgreSQL stores metadata only.
Classification (public → highly sensitive), retention and deletion jobs, data lineage and access logs.

Append-only, hash-chained audit ledger per tenant enforced by a database trigger, daily HMAC anchors held outside the database.
Every decision stores the policy version, the facts hash and a full explanation.

Strict transport security, CSP-ready headers, CSRF protection, signed webhooks, idempotent commands, hierarchical rate limits.
Dependency auditing and static analysis in CI; independent security review before every major release.

security@authpermit.app — we acknowledge within one business day.