Eniyan Docs

Security controls

The controls live in production today, by area. This is the reference behind the public security page; for exact operational values (limits, thresholds, taxonomies) request the NDA pack via security@eniyantrust.com.

Authentication

  • Password complexity requirements enforced at signup and change
  • Account lockout after repeated failed attempts, with automatic cooldown
  • Server-side session revocation on logout — a logged-out token is dead immediately
  • TOTP/MFA (RFC 6238) — per-user opt-in and org-level enforcement

Exact values and designs for this area are shared with customers under NDA.

API security

  • API keys stored as SHA-256 hashes; plaintext shown once, never stored
  • Configurable API-key expiration
  • Per-key IP allowlisting (CIDR ranges supported)
  • Per-surface rate limiting, keyed so shared-egress enterprises don't collide

Exact values and designs for this area are shared with customers under NDA.

Transport & headers

  • TLS everywhere with HSTS
  • Strict browser security headers: frame denial, content-type sniffing protection, restrictive CSP, referrer policy

Data protection

  • AES-256-GCM field-level encryption for PII at rest
  • Database TLS required in production
  • Biometric data never stored — the optional ID-upgrade check is processed by the certified provider only
  • SHA-256 consent text hashing for tamper-evident consent records

Observability

  • Structured logging with per-request correlation IDs
  • A comprehensive audit event taxonomy spanning auth, sessions, credentials, and the full agent lifecycle
  • Tamper-evident, hash-chained audit log with a 7-year retention policy

Exact values and designs for this area are shared with customers under NDA.

KYA — agent security

  • Cloud attestation verified against each provider's signed instance evidence (AWS, GCP, Azure)
  • Operator accountability chain — revoking the human cascade-suspends every linked agent
  • Lifecycle enforcement — retired agents cannot issue new sessions
  • Automatic re-verification on material agent changes (e.g. a model swap)
  • W3C Verifiable Credentials — offline-verifiable agent identity via JWKS
  • Sub-agent delegation opt-in and bounded: children capped by the parent's trust and scopes, no deep nesting, cascade suspension

Exact values and designs for this area are shared with customers under NDA.

Privacy & compliance

  • GDPR Article 15 (access) and 17 (erasure) via the Privacy Portal
  • CCPA consumer deletion requests
  • BIPA informed consent with hashed consent records
  • Automated data anonymization on a scheduled retention cycle