Security & privacy
A cryptosystem must be secure even if everything about it is known, except the key. Kerckhoffs wrote that in 1883; we agree. What follows is the implementation as it actually ships today — what's live, what isn't yet, and where to write if you find a gap we haven't.
01 — Authentication
Authentication is the first signal of how seriously the rest of the platform is taken. Cybsis treats it that way.
Session model
Short-lived JWT access tokens (15 minutes, configurable) carried in httpOnly SameSite=Strict cookies, with audience and issuer validation. Refresh tokens are 48 random bytes, stored SHA-256-hashed at rest — the plaintext only ever exists in the browser cookie. Idle timeout configurable per instance; default 60 minutes. Per-route rate limits on every authentication endpoint (e.g. password: 10 requests / 15 minutes; passkey registration: 20 / 5 minutes).
02 — Authorization & isolation
03 — Encryption
Sensitive config
AI provider API keys, SMTP/IMAP credentials, and other secrets in the system configuration are encrypted with AES-256-GCM at the field level — 12-byte IV plus 16-byte authentication tag prepended to the ciphertext. RaulWalter staff cannot read them; the database row alone is not enough.
Uploaded files
Each file gets its own derived key via HMAC-SHA256(master, "file:" + fileId) — HKDF construction. The master key encrypts nothing directly; compromising one file key compromises one file.
Passwords
Bcrypt-hashed. The database stores hashes only; password resets generate short-lived signed tokens, never the plaintext.
Refresh tokens
Stored as SHA-256 hashes. Even with full database access, an attacker cannot replay a session — they would need the plaintext from the user's browser cookie.
Master key
Lives in the ENCRYPTION_KEY environment variable — 32 bytes, base64-encoded. On self-host and on-prem deployments the key never leaves the customer's infrastructure; RaulWalter has no copy. On RW Hosting the key lives in the customer's isolated AWS environment, never on developer laptops and never in version control.
In transit
TLS terminates at the reverse proxy (nginx in the recommended deployment). Cybsis does not accept plaintext HTTP for authenticated traffic.
04 — Audit & accountability
05 — Deployment & data residency
AWS eu-north-1 · €300/yr flat
Single-tenant per customer, isolated AWS account, encrypted at rest. RaulWalter operates the runtime — same-day updates, active support, telemetry visible to us to make support fast. The trade-off you pick if you don't want to run the infrastructure.
AWS · GCP · Azure · no extra charge
Docker image, deployment documentation, you run it. The encryption master key lives in your secret store; RaulWalter has no read access to your database, no shell on your instances. Licence checks against our licence server are the only outbound calls.
Defence · intel · healthcare · no extra charge
Same Docker image, customer-installed. Air-gapped operation via the air-gapped licence path. Zero outbound. If the AI features are enabled with a self-hosted model provider, the entire stack runs inside the perimeter.
Database & backups
PostgreSQL 17 is the default and the database we test against. Because the data layer sits on Prisma with no PostgreSQL-specific column types, JSON operators, or extensions, MySQL and SQLite are supported provider targets at the schema level — viable when an organisation has standardised elsewhere and is willing to operate the deployment themselves. The schema discipline is deliberate, not accidental.
Built-in backup tooling runs pg_dump on a tiered schedule — hourly, daily, weekly — with configurable retention. On self-host you point the backup volume at your storage of choice; on RW Hosting backups land in customer-isolated S3. Non-Postgres deployments use the operator's own backup tooling.
06 — AI trust boundary
AI is the only feature that can move data outside your trust boundary. So it's the one we treat with the most ceremony.
07 — What's on the security roadmap
Kerckhoffs's principle cuts both ways. If we expect you to trust the implementation, we owe you a list of the things that aren't in it yet.
TOTP as a second factor
The platform encourages passkeys, which are stronger than password + TOTP for phishing-resistance. But environments that mandate TOTP — particularly public-sector procurement frameworks — need an explicit second factor on top of password. On the next minor release.
SAML SSO
OIDC is already supported via the TARA integration; generic OIDC against any IdP is a small extension. SAML — for the enterprises whose IdP team only speaks SAML — is on the backlog and gated behind the first customer who actually requires it.
Tamper-evident audit log
The audit log is comprehensive but the rows are mutable like any other database table — a database administrator with write access can edit history. A hash-chain or append-only-storage construction is the planned hardening; it matters most for regulated sectors where the auditor needs cryptographic non-repudiation.
Automated supply-chain scanning
The lockfile is committed and reviewed on every release, but we don't yet run automated Dependabot or Renovate against the repo, and there's no published SBOM. Both are on the next-quarter list.
AI prompt PII redaction
The platform-constructed portions of an AI prompt are already minimised — controlled fields with capped sample sizes, no credentials, no national identifiers. What doesn't yet exist is an automatic scrubbing layer over user-authored prompt content: a comment or freeform note typed into a sparkle-button input goes to the provider verbatim. A redaction pass — entity detection, configurable patterns, instance-level policy — is on the build list.
Bug bounty programme
Coordinated disclosure via the email below is the contract today. A funded bounty programme — likely via a public platform — opens once we have enough installed base for it to be meaningful for researchers.
08 — Responsible disclosure
If you've found a security issue in Cybsis — in the product, the website, or any integration we publish — write to security@raulwalter.com. We acknowledge within 24 hours of receipt, every day of the year.
PGP — encrypt sensitive reports
Fingerprint: 3361 FEA1 BF78 5BDA A1BF 0385 860E 681F 87FF 816A
Key: /.well-known/security-raulwalter.asc · also referenced in /.well-known/security.txt
What we'll do
What we ask you to do
For non-security questions about the product, use the quote form or write to sales@raulwalter.com. The security inbox is monitored separately and should be reserved for vulnerability reports.
