ABOUT KYOROX • ENGINEERING-FIRST AUTHENTICATION INFRASTRUCTURE
Stateless SAML 2.0-to-JWT Middleware
Engineering Simplicity and Zero-PII Security into Enterprise Authentication.
We built KyoRox to eliminate the two biggest bottlenecks in B2B SaaS growth: spending weeks coding fragile SAML 2.0 XML parsers and paying punitive per-user identity taxes just to close enterprise deals.
THE ARCHITECTURAL MISSION
Why We Engineered a Dedicated Stateless SAML Proxy.
Created by an engineering-first security and authentication infrastructure team focused exclusively on solving enterprise SAML 2.0 federation without database PII liability.
THE LEGACY IDENTITY BOTTLENECK
Bloated User Databases & Punitive MAU Taxes
Traditional identity clouds force B2B SaaS teams into an expensive architectural trap:
- ✕ Third-Party PII Honey-Pots: Storing customer employee emails and names in an external identity broker's database triggers weeks of GDPR and HIPAA sub-processor reviews.
- ✕ Unpredictable Per-User & $125/Conn Fees: Legacy brokers charge $125+/month per SAML connection or penalize you as your enterprise customers onboard more employees.
- ✕ Fragile In-House XML Dependencies: Maintaining C-level XML signature verifiers across polyglot backends introduces XXE and XML Signature Wrapping (XSW) risks.
THE KYOROX ENGINEERING STANDARD
Pure Stateless SAML 2.0-to-JWT Protocol Translation
KyoRox is a single-purpose, high-throughput stateless proxy engine and Customer Control Plane:
- ✓ 100% Volatile RAM Execution (<12ms): Verifies SAML 2.0 assertions from Okta, Microsoft Entra ID, Google Workspace, JumpCloud, PingIdentity, and Custom SAML 2.0 in memory and wipes them immediately.
- ✓ Deterministic RFC 7519 HS256 JWT Output: Your backend verifies a single standard JSON Web Token in 8 lines of code—zero XML libraries required.
- ✓ 5-Minute Self-Serve Control Plane: Instant tenant provisioning, Hosted OASIS SP Metadata XML, X.509 expiry radar, and atomic API key rotation.
OUR CORE PURPOSE • WHY WE ENGINEERED KYOROX
Built to End the Enterprise “SSO Tax” and Eliminate Fragile XML Engineering Debt.
We engineered KyoRox with a single, uncompromising objective: to decouple enterprise SAML 2.0 security from predatory per-user pricing and months of complex cryptographic maintenance. Modern B2B SaaS platforms should never lose an enterprise deal because legacy identity brokers charge thousands of dollars for basic workforce authentication or force customer employee PII into third-party storage.
ECONOMIC PURPOSE
01. Democratizing Enterprise Readiness (Killing the SSO Tax)
Enterprise single sign-on is a baseline security requirement, not a luxury feature. We built KyoRox to replace punitive $125+/connection fees and unpredictable Monthly Active User (MAU) overages with transparent, flat-rate self-serve tiers starting at $39/month (+ applicable local taxes).
ENGINEERING PURPOSE
02. Turning Weeks of SAML XML Debt into a 5-Minute JWT Handoff
Product engineering teams should focus on building their core application—not debugging brittle OASIS SAML 2.0 XML schemas, XXE/XSW attack vectors, or manual X.509 certificate expirations. KyoRox abstracts the entire SAML handshake into a deterministic, sub-12ms HS256 JWT redirect.
SECURITY PURPOSE
03. Removing Third-Party PII Liability from Enterprise Procurement
Traditional identity aggregators persist employee personal data on disk, triggering months of GDPR and InfoSec compliance friction during enterprise sales cycles. Our 100% Stateless Volatile RAM architecture processes assertions in memory and writes 0 bytes of end-user PII to disk—allowing your security reviews to pass effortlessly.
Our Mission in One Sentence: Empower every B2B software team to onboard Okta, Microsoft Entra ID, Google Workspace, JumpCloud, and PingIdentity customers in under 5 minutes—with zero PII disk liability and zero MAU penalties.
FOUNDATIONAL TENETS
Our 4 Core Engineering Principles.
Every line of code in the KyoRox gateway and Customer Control Plane is governed by four non-negotiable architectural rules.
Stateless Volatile RAM by Default
Every SAML 2.0 XML assertion is parsed, verified, normalized into an HS256 JWT, and garbage-collected strictly inside volatile system memory. KyoRox writes 0 bytes of end-user employee PII to persistent disk storage or logs—eliminating third-party data residency liability.
Defense-in-Depth Cryptography
We enforce pinned X.509 RSA-SHA256 signature verification, pre-parse XXE/DTD and XSW shields, AES-256-GCM secret encryption at rest (unique 96-bit IV + 128-bit Auth Tag), irreversible constant-time SHA-256 API key hashing, and a 300-second atomic AssertionID nonce replay lock.
Radical Pricing Transparency
We offer three flat, self-serve monthly tiers—Starter ($39/mo — 1 Connection), Growth ($139/mo — 5 Connections), and Enterprise ($349/mo — 999 Connections)—with unlimited active users, plus applicable local VAT/GST/Sales Tax calculated transparently at checkout via our Merchant of Record (Lemon Squeezy).
Self-Serve Developer Autonomy
No mandatory sales calls or multi-week onboarding queues. Enjoy instant automated webhook provisioning, a cookie-free sessionStorage 7-view Control Plane (/dashboard), Email OTP recovery, 1-click atomic key rotation, and proactive 30/14/7-day X.509 certificate expiry radar.
5-LAYER PRODUCTION SECURITY TOPOLOGY
Production Architecture & Security Stack Highlights
LAYER 01
TLS 1.3 High-Availability Edge Termination & Strict Payload Sanitization
EDGE HARDENING
HSTS-preloaded TLS 1.3 transport encryption, 64KB XML payload cap, and pre-parse rejection of DTD/XXE entity declarations.
LAYER 02
Stateless Volatile RAM SAML 2.0 XML Verification & Claim Normalization Engine
0 BYTES DISK PII
Sub-12ms X.509 RSA-SHA256 signature verification, XML Signature Wrapping (XSW) node pinning, and RFC 7519 HS256 JWT issuance with 0 bytes of PII written to disk.
LAYER 03
300-Second Atomic Nonce Replay Shield & Strict Redirect URI Whitelist Guard
ANTI-REPLAY LOCK
Atomic in-memory AssertionID locking (300s TTL) against MitM replay attacks and strict HTTPS callback URI whitelist verification.
LAYER 04
FIPS-197 AES-256-GCM Encrypted Secret Vault & Constant-Time SHA-256 Auth
FIPS-197 VAULT
Authenticated encryption at rest (unique 96-bit IV + 128-bit Auth Tag) for signing secrets and irreversible SHA-256 API key hashing.
LAYER 05
Ephemeral Cookie-Free Control Plane & Automated Lifecycle Telemetry
COOKIE-FREE UI
Tab-scoped sessionStorage workspace custody, Email OTP recovery, atomic key rotation, and 30/14/7-day X.509 certificate expiry radar.
OPERATIONAL GOVERNANCE & COMPLIANCE
Direct Engineering Support & Merchant Transparency.
Clear accountability for enterprise procurement teams, security auditors, and global subscription billing.
Official Support & Systems Engineering Desk
Every technical integration question, SAML metadata inquiry, or security review request is handled directly by systems engineers within our guaranteed 24 to 36 hour resolution SLA.
Global Billing, Tax Compliance & 14-Day Refund Policy
All subscription payments, tax-compliant invoices, and regional VAT/GST/Sales Tax calculations (including B2B reverse-charge Tax ID exemptions) are processed by our authorized Merchant of Record, Lemon Squeezy, backed by our transparent 14-day initial refund policy.
COMPLETE PLATFORM DIRECTORY
Explore Every KyoRox Resource & Policy.
Direct 1-click access to our product architecture, developer documentation, live telemetry, and legal governance pages.
01 • PRODUCT & ONBOARDING
Architecture & Control Plane
02 • TRUST, STATUS & SUPPORT
Verification & Live Telemetry
03 • LEGAL & GOVERNANCE
Terms, Tax, Privacy & Security
Verified Digital Footprint & Open-Source Proof
Independently Verified Across Global Developer & Trust Directories
Every enterprise buyer, security auditor, and payment compliance reviewer can independently verify KyoRox's DNS-authenticated repositories, public review portal, and technical benchmarks in one click.
✓ DNS VERIFIED (kyorox.com)
GitHub Organization & Verifiers
Official DNS-verified GitHub organization (Kyorox-official) hosting our zero-dependency Node.js and Python HS256 JWT verification repositories.
✓ CLAIMED DOMAIN PROFILE
Trustpilot Public Review Portal
Official domain-verified Trustpilot profile for kyorox.com where B2B SaaS engineering teams share verified production onboarding experiences.
✓ OFFICIAL COMPANY PAGE
LinkedIn Corporate Identity
Connect with KyoRox on LinkedIn for enterprise identity architecture updates, SAML 2.0 security advisories, and B2B engineering announcements.
✓ @kyorox_official
Official X (Twitter) Channel
Follow @kyorox_official for real-time gateway release notes, P99 volatile RAM latency telemetry, and direct developer updates.
✓ TECHNICAL BENCHMARKS
Dev.to Engineering Publications
Read our deep-dive engineering articles on stateless SAML 2.0 XML signature pinning, 300s Redis replay shields, and flat-rate pricing vs. WorkOS/Auth0.
✓ INDEPENDENT DIRECTORY
SaaSHub Product Listing
Listed and categorized on SaaSHub as a verified flat-rate, zero-PII Enterprise Single Sign-On (SAML 2.0) alternative to legacy identity brokers.