Skip to main content
Security

Security at Secuvon

Security is at the core of everything we build. We protect your data and your AI agents with industry-leading practices.

66

Documented Threat Models

Fernet

API Key Encryption (AES-CBC + HMAC)

bcrypt

Password Hashing (12 rounds)

Encryption at Rest

  • API keys encrypted with Fernet (AES-128-CBC + HMAC-SHA256)
  • Scan evidence encrypted before storage
  • Database TLS is required by deployed-environment validation
  • Runtime secrets are loaded from deployment environment variables

Authentication & Access

  • Passwords hashed with bcrypt (12 rounds)
  • JWT access tokens (30min) + refresh tokens (7 days)
  • Token revocation via JTI blacklisting
  • Rate limiting on authentication and API operations (slowapi)

Network Security

  • SSRF prevention: blocks localhost, private IPs, cloud metadata endpoints
  • CORS restricted to allowed origins only
  • TrustedHost middleware against host header attacks
  • Security headers: HSTS, CSP, X-Frame-Options, X-XSS-Protection

Data Protection

  • Hosting region is selected by each deployment operator
  • Provider secrets are never returned by agent or credential responses
  • Organisation-scoped retention and user data export/erasure workflows
  • Application audit API is append-only; configured retention purges old records

Application Security

  • Pydantic input validation on all endpoints
  • Parameterised database queries (SQLAlchemy ORM)
  • Non-root Docker containers in production
  • Multi-stage Docker builds (minimal attack surface)

Incident Response

  • Responsible disclosure program
  • Vulnerability reporting through the persisted contact form
  • Configurable webhook channels for security and scan events
  • Audit events for authentication and security-sensitive operations

Responsible Disclosure

Found a security vulnerability? We appreciate responsible disclosure. Use the contact form and choose Report a Security Issue; acknowledgement and remediation timing depend on severity and available capacity.

We do not pursue legal action against researchers who follow responsible disclosure practices.