Security & compliance
Identity, authorization, isolation, cryptographic integrity, and evidence controls across LocusVia.
Control model#
Strong identity
Administrative access uses authenticated sessions and supported enterprise identity providers.
Least privilege
Roles constrain reads, mutations, secret rotation, replay, and platform administration.
Tenant isolation
Data and requests require matching tenant and environment scope.
Audit integrity
Material administrative actions produce ordered, tamper-evident evidence.
Edge and SDK protection#
Public resolution exposes only the data required to route a link. SDK endpoints require scoped credentials, validate payloads, and apply abuse controls without storing raw client network identifiers.
Secrets and encryption#
Secrets are returned only when the product workflow requires one-time disclosure, encrypted at rest, and never included in public logs or documentation. Signed workflows use bounded replay windows and constant-time verification.
Compliance evidence#
Control evidence is tied to a specific environment and observation time. A policy or test result is not presented as production runtime proof.
Note
Contact LocusVia for the current security package, subprocessors, and environment-specific evidence.