Security
Our security posture, stated plainly.
We sell enforcement, so it would be a strange thing to be vague about. This page says what Authoric does and does not do today — no certifications we have not earned, and no dates we cannot hit.
What we don't have
Start with the gaps.
If any of these is a hard requirement for your organization, you should know it in the first minute rather than the third meeting.
SOC 2
We hold no SOC 2 report, and no audit is underway. We will say so here on the day one is.
HIPAA / BAA
We do not sign Business Associate Agreements today, and Authoric should not be used as the system of record for PHI on that basis.
Third-party penetration test
No independent penetration test has been commissioned yet. Our security work so far is internal.
Customer-managed keys
Secrets are encrypted with a key we hold. There is no BYO-KMS, and no option to supply your own key material.
Self-hosting
Authoric is a cloud service. There is no self-hosted or on-premise deployment, so data residency is not something you control today.
We are building toward these deliberately rather than announcing them early. When one lands, it will be described here in the same detail as everything below.
What we do enforce
The controls that are real today.
These are properties of the running system rather than promises about it — each one is enforced by the platform on every request, including requests made by AI.
Authorization is deny by default
Every request — from a person, a service, or an AI agent — is evaluated against a declarative policy. Capability comes from an explicit grant; anything not granted is denied, including for an agent that has been talked into asking for it.
High-risk actions stop for a human
Operations are graded low, moderate, or high. Anything above low pauses the run and waits in an approval inbox showing the exact arguments, and the principal that raised it cannot approve its own request.
Every action is attributed and recorded
Actions land in a queryable audit trail carrying the acting principal, the organization, and the payload — the same trail whether a human, an API key, or an agent took the action.
Sensitive columns are redacted at the wall
Columns marked for redaction are stripped server-side before a row reaches an SDK caller or the REST API, so a model never receives the value it is not entitled to read.
Each app gets its own database
Isolation is physical rather than a WHERE clause: an app's data lives in its own database, and cross-scope reads require an explicitly granted capability.
Passwords use the NIST-approved KDF
PBKDF2-HMAC-SHA256 at 600,000 iterations — OWASP's floor — in a self-describing stored format. PBKDF2 is chosen over nominally stronger alternatives because it is the option available inside a FIPS-validated deployment.
Secrets are encrypted at rest
Stored credentials, including your model provider keys, are encrypted with AES-256-GCM before they are written.
Two-factor authentication
TOTP and SMS second factors, enforced at every point a session is issued. An organization can require 2FA of its members; un-enrolled members get a restricted session that can only complete enrollment.
Your model keys stay yours
Bring your own Anthropic or OpenAI connection. We do not resell or mark up tokens, and your prompts and completions are a matter between you and your provider.
Reporting a vulnerability
Found something? Tell us.
We would rather hear it from you than read about it. Write to us with the details and we will confirm receipt, keep you updated while we work, and credit you if you would like to be credited.
Please do not test against another organization's data, and do not run denial-of-service or spam tests against the platform. Everything else is fair game, and we will not pursue anyone acting in good faith.