Trust Centre
Security you can verify
Zynth Auth is built fail-closed, isolates tenants at the database, and ships from a signed, contained supply chain. Here is exactly what that means — and the frameworks our controls map to.
Security controls
Enforced, not aspirational
The controls below are how the platform actually behaves in production today.
Fail-closed by design
A missing key, unreachable dependency, or ambiguous authorization results in denial, never insecure degradation. There is no dev-mode fallback in staging or production.
Encryption in transit & at rest
TLS everywhere (auto-renewed certificates), and encryption at rest for sensitive data. Passwords are hashed with Argon2id; we never store plaintext credentials.
Tenant isolation at the database
Multi-tenancy is enforced with Postgres row-level security and a scoped repository layer — the tenant boundary is a database property, not a hand-scoped query you have to trust.
Least-privilege data access
The request-path database role can only read and write rows — it cannot alter schema, drop tables, or reach another database. Workers and the audit sealer hold separately-scoped roles.
Tamper-evident audit log
Security-relevant actions are written to a hash-chained audit log that makes silent modification detectable, sealed by a dedicated append-only role.
Modern authentication
RS256-signed tokens with published JWKS, WebAuthn passkeys, TOTP MFA, active login throttling, and httpOnly, SameSite=Strict refresh cookies.
Supply chain
Signed and contained, end to end
The software that runs your identity layer is built, signed, and boxed in — so even a compromised dependency is contained.
Cosign-signed, digest-pinned images
Images are built in CI and signed keyless (GitHub OIDC). The server never builds — it verifies every signature and deploys the exact verified digests, aborting on any verification failure (ADR-0021).
Egress network control
Application containers have no direct route to the internet; every outbound call goes through an allowlist proxy. Data cannot flow to a destination we have not vetted (ADR-0020).
Runtime containment
Services run non-root, read-only rootfs, no-new-privileges, with all Linux capabilities dropped. Datastores sit on internal-only networks with no internet at all (ADR-0002).
Defense-in-depth against malicious code
Blocking SAST (Semgrep), dependency auditing, pinned GitHub Actions, OSSF Scorecard, and Socket.dev — layered on top of runtime containment, because no scanner is trusted alone (ADR-0002).
Protected, reviewable delivery
Branch protection applies to administrators; every change is a reviewed pull request through required checks that cannot be bypassed, including by the owner.
Coverage guards by construction
Every new action must emit telemetry, carry a detection decision, an audit decision, and map to a compliance control — mechanically enforced in CI, so observability and evidence can't silently rot.
AI-agent security
Governance for autonomous agents
Agents are first-class principals — identified, delegated, and enforced at the moment they act.
Agent identities & delegation
Every agent has a cryptographic identity and tighten-never-weaken delegation from the human it acts for, with a separately-permissioned kill switch.
MCP per-call authorization
A fail-closed gateway sits in front of an agent's MCP tool calls: allowlist, delegation scope, rate and budget caps, and a bounded, egress-proxied upstream hop.
Human-in-the-loop approvals
Sensitive agent actions can require real-time approval, fingerprint-bound and single-use, with an owner-only break-glass path that always alerts.
Compliance
Controls mapped to the frameworks buyers ask for
Every audited action maps to at least one compliance control, so evidence is produced by construction — not reconstructed before an audit.
SOC 2
Controls mappedTrust Service Criteria — access, monitoring, change
ISO/IEC 27001
Controls mappedAnnex A controls + ISMS (risk, policy, assets)
GDPR
Controls mappedData-subject rights, consent, storage limitation
Singapore PDPA
Controls mappedProtection obligation
Philippines DPA
Controls mappedSecurity of personal information
HIPAA
Controls mappedPHI audit controls, breach notice, encryption
EU AI Act
RegisteredHuman oversight, logging, transparency
ISO/IEC 42001
RegisteredAI management system
OWASP Agentic Top 10
RegisteredAgent authorization, tool misuse, provenance
On certification: our controls are built to and mapped against these frameworks, and the platform produces continuous audit evidence. Formal third-party certifications and attestations are on our roadmap. For our current compliance package, contact sales@zynthmedia.com.