Controls that exist today — and what doesn’t yet

Maintained library (Better Auth) for password hashing and sessions; HttpOnly, SameSite=Lax cookies; Secure in production.

Six roles (owner, admin, developer, operator, approver, viewer) enforced by the API on every request; tenant id applied to every query.

Hashed (SHA-256), shown once, scoped to the creator’s permissions, expiring, revocable, invalidated if the creator is removed. Cannot approve.

AES-256-GCM with per-record associated data binding ciphertext to the organization; never returned by the API, never logged, never sent to a model.

Encrypted at rest; displayed redacted (declared sensitive fields and secret-looking keys); purged after the retention period.

HTTPS only, host allowlists, private/loopback/link-local/metadata ranges blocked at connect time (DNS-rebinding safe), no redirects, timeouts, response size caps.

Bound to a hash of the exact payload, target and policy version; expiring; separation of duties; dual control for high-impact actions.

Idempotency keys unique per workspace; non-idempotent actions are never blindly retried.

Audit events and receipts are append-only (database triggers block edits); receipts are hash-chained per workspace.

HMAC-SHA256 signatures with timestamps (5-minute replay window) and event ids for deduplication; inbound payment webhooks verified and idempotent.

Token-bucket rate limits per key, user and organization; plan quotas; request size limits.

Origin checks on cookie-authenticated mutations, CSP, X-Frame-Options DENY, nosniff, HSTS in production.

See operational metadata only. Reading a tenant’s audit log needs a break-glass grant approved by a second operator; time-limited and recorded in the tenant’s own log.

Execution runs in a separate worker process, never in API request handlers. Only registered connector operations run; no arbitrary code or shell.

Not implemented.

Interface exists; only application-level encryption ships.

Workers are shared processes; container/VM isolation for hostile workloads is planned.

Inline scripts are currently allowed for the web app framework.

Voidex holds no SOC 2, ISO 27001 or similar certification. The product provides controls that can support your own compliance work.