Security — Gatewyse

Credential management

Provider API keys are encrypted at rest with AES-256-GCM. The tenant ID is used as additional authenticated data (AAD), so ciphertext is bound to its tenant — a key intended for tenant A cannot be decrypted in tenant B's context. Ciphertext is version-prefixed (v1:…) to support algorithm rotation without breaking historical data. The key source is pluggable behind a KeyProvider seam for KMS / BYOK integrations.

Password hashing

Argon2id only. Memory-hard, resistant to GPU and ASIC attacks. Configurable cost parameters per deployment; sane defaults exceed OWASP 2024 recommendations.

Audit trail

Every mutating action — CRUD on providers, routing configs, users, budgets, API keys — produces an immutable log entry. Each entry carries a SHA-256 hash of the previous entry concatenated with the current payload. Tampering breaks the chain and is detectable with a single verify pass. Sequence numbers prevent reordering. TTL indexes enforce configurable retention (default 365 days).

Prompt & response guard

A configurable pipeline runs on every request and response. Built-in guards include regex PII detectors (SSN, credit card, email, phone, IP, API key), LLM moderation callbacks, and custom guard plugins. Actions: block, redact, mask, or hash. Configurable per tenant with priority ordering.

Single sign-on & SCIM

OIDC and SAML out of the box, with pre-configured templates for Okta, Microsoft Entra, Google, and generic IdPs, plus SAML Single Logout. SCIM 2.0 automates user and group provisioning from your IdP, and IdP group claims map to gateway roles on every login. An escalation guard means no IdP or SCIM client can ever grant super-admin. Per-tenant identity isolation throughout.

MFA & session control

Self-service TOTP multi-factor enrollment with one-time recovery codes and replay protection. Users can list and revoke their active sessions; admins can force-logout. Refresh tokens rotate on every use with reuse detection — a replayed rotated-out token revokes the entire session family.

GDPR data-subject rights

Per-user data export (Article 15) returns a tenant-scoped, secret-free bundle. Erasure (Article 17) anonymizes the user and scrubs captured request/response bodies while leaving the tamper-evident audit chain intact, so the right to be forgotten never breaks your compliance record.

Provider circuit breaker

Each provider runs behind a circuit breaker state machine. After 5 consecutive failures, the circuit opens and requests route around it for 60 seconds. It then enters half-open and probes with a single request; a success closes it, a failure re-opens for another 60s. No cascading failures under provider outages.

IP allowlisting

API keys can restrict access to specific CIDR ranges. Combined with tenant-scoped scopes and per-key capability restrictions, a compromised key has a bounded blast radius.

Data retention & residency

Request bodies are not logged by default. Opt in per route for compliance workflows. Audit metadata retention is configurable; sensible defaults are SOC 2-aligned. Self-host means your data never leaves your infrastructure.

Encryption key rotation

Super-admins can trigger an encryption key rotation that re-encrypts all stored credentials atomically. Old ciphertext remains decryptable via version-prefixed keys until the re-encryption completes, with no downtime for the running gateway.

SOC 2 readiness

The architecture is designed for SOC 2 certification: immutable audit log with cryptographic integrity, access controls, encryption at rest and in transit, provider circuit breakers, rate-limiter fail-closed behavior, principle of least privilege enforced via RBAC. We partner with customers during the audit process when certification is required.