Security & Compliance

All API credentials are encrypted using AES-256-GCM before storage. Each tenant has a unique encryption key derived from a master key using HKDF. Even in the unlikely event of database compromise, credentials remain protected.

All API communication uses TLS 1.3 with perfect forward secrecy. Credentials are never transmitted in plaintext. Automatic certificate rotation and HSTS enforcement prevent downgrade attacks.

Every request is authenticated and authorized independently. No implicit trust based on network location. IP allowlisting, client identification, and route-level access controls ensure only authorized requests succeed.

// Every request requires multi-layer authentication
const request = {
  headers: {
    'X-KnoxCall-API-Key': 'kc_...',        // API key auth
    'X-KnoxCall-Client-ID': 'device-123', // Client tracking
    'X-KnoxCall-Route': 'stripe-charge'  // Route authorization
  }
};

// Automatic checks before proxying:
// 1. API key valid & not revoked
// 2. Client IP in allowlist (if configured)
// 3. Route exists & tenant has access
// 4. Rate limits not exceeded
// 5. Request signing validated (if enabled)

Every API request, credential access, and configuration change is logged with cryptographic integrity protection. Logs are append-only and retained for compliance requirements (30-365 days configurable).