Security Model

• Mobile SDK clients are public clients. SDK API Keys are not secrets.
• Only key hashes are stored server-side. Raw keys are shown once at creation.
• Keys are sent only in Authorization: Bearer headers. Never in URLs.
• Scoped by Tenant, Environment, allowed SDK App IDs, and SDK Scopes.
• Support revocation and rotation without SDK redeploy.

All three must agree for any SDK request:

• SDK Base URL host resolves to the correct Domain and Environment.
• API Key belongs to the same Environment.
• SDK App ID belongs to the same Environment.

• Deterministic matching only by default.
• No raw IP storage. No full user-agent fingerprint storage.
• Short Click Context TTL with aggressive expiry.
• No tenant ID in SDK response metadata.
• No clipboard attribution by default.
• Probabilistic matching requires explicit tenant opt-in.

• Admin Users access tenants through Tenant Memberships with fixed roles.
• All config writes affecting domains, links, and association files are recorded to the audit log.
• Config is published through explicit versions for review and rollback.
• Rate limiting by key, SDK App ID, domain, IP bucket, and anomaly signals.

LocusVia provides a scoped, evidence-backed customer security evidence pack covering authentication, tenant/environment isolation, SDK/Admin API security, webhook signature integrity, audit logging, backup/restore, dependency management, and retention.

As of 2026-08-05, LocusVia holds no SOC 2, ISO/IEC 27001, CSA STAR, or PCI DSS certificate or attestation report, and no readiness work is claimed as certified, audited, attested, or compliant. Design and operating evidence is documented in the compliance registers; operating effectiveness across a dated period is not yet established.