Data Protection & Security Controls

1. Cryptographic Storage & Key Management

AuthSetu maintains a strict zero-plaintext policy across all storage tiers:

• Secrets & API Keys: API client secrets are salted and hashed using SHA-256 / Argon2 before database persistence. Raw secrets are shown exactly once during creation.
• JWT Key Pairs: Application RS256/ES256 private keys are stored encrypted at rest with hardware-backed Key Management Service (KMS) envelope encryption.
• Session Caching: Redis session caches utilize short-lived TTLs and encrypted payloads.

2. Multi-Tenant Database Isolation

Every database query executes within strict application context barriers:

• Logical Isolation: Row-level security and explicit tenant-scoped queries prevent cross-tenant data leakage.
• Dedicated Clusters: Enterprise tiers can provision isolated database replicas and custom VPC peering endpoints.
• Soft Delete Protections: Deleted records are flagged with `isDeleted` and timestamped before scheduled purge execution.

3. Immutable Audit Trails

All administrative changes, role modifications, API key generation, and login attempts produce structured, immutable audit log events. Audit records are searchable in real-time in the dashboard or exportable via Webhook / SIEM integrations.

4. Security Questions & Reporting

To report a potential vulnerability or request SOC2 / ISO compliance documentation, visit our security desk: