GENERAL AVAILABILITY • PRODUCTION RELEASE LOG Instant Automated SaaS Fulfillment

Engineered for Stability. Built for Instant Enterprise Fulfillment.

Explore the core architectural milestones powering KyoRox's 100% Stateless SAML 2.0 Proxy Engine and automated customer control plane.

Current Production Build: v2.4.0-GA (General Availability) Active Production Build: v2.4-Stable • Continuous Cryptographic & Dependency Hardening Active • Verified Today
Live Telemetry →
1. Active Release Channel v2.4.0-GA (100% Live)
2. Automated Security & Runtime Verification Verified Today (UTC)
3. Gateway Health Probe (sso.kyorox.com) 100% Operational (TLS 1.3)
v2.4.0-GA LATEST STABLE RELEASE • GENERAL AVAILABILITY

2026 Multi-View Customer Control Plane, Live IdP Setup Wizard & Self-Serve Key Rotation

  • ✓ Self-Serve Customer Control Plane: Full production release of the multi-view Customer Control Plane (kyorox.com/dashboard) with tab-scoped sessionStorage isolation and zero persistent browser cookies.
  • ✓ Interactive Provider Setup Studio: Built-in SAML 2.0 configuration blueprints and attribute normalization for Okta Workforce, Microsoft Entra ID, Google Workspace, JumpCloud, PingFederate, and Custom SAML 2.0.
  • ✓ Atomic Key Rotation & X.509 Expiry Radar: Self-serve live API Key and 256-bit JWT secret rotation protected by bound owner email OTP guards, paired with automated 30 / 14 / 7-day X.509 certificate expiry email alerts.
CONTROL PLANE STUDIO • v2.4.0-GA LIVE
HOSTED OASIS SP METADATA & ACS ENDPOINTS https://sso.kyorox.com/metadata/{TENANT_UUID} X.509 EXPIRY RADAR 30 / 14 / 7-Day Alerts ATOMIC KEY ROTATION Email OTP Guarded ✓ Tab-Scoped sessionStorage • Zero Persistent Cookies
v2.0.0 PRODUCTION MILESTONE • AUTOMATED FULFILLMENT

Instant Webhook Tenant Provisioning, Dynamic Tier Quotas & Self-Serve Credential Recovery

  • ✓ Sub-3-Second Automated Fulfillment: HMAC-SHA256 verified billing webhooks provision an isolated UUID v4 tenant workspace, AES-256-GCM encrypted JWT signing secret, and SHA-256 hashed API key immediately upon subscription checkout.
  • ✓ Dynamic Plan Quota Enforcement: Real-time enforcement and instant upgrade/downgrade synchronization across Starter (1 IdP Connection), Growth (5 IdP Connections), and Enterprise (Unlimited / 999 Connections).
  • ✓ Self-Serve Workspace Recovery: Built-in pre-checkout email OTP verification and self-serve credential recovery directly on the Control Plane login gate.
INSTANT SAAS FULFILLMENT (< 3 SECONDS) AUTOMATED
01. SUBSCRIPTION CHECKOUT CONFIRMED HMAC-SHA256 Webhook Signature Verified 02. ISOLATED TENANT & AES-256-GCM VAULT CREATED UUID v4 + 256-Bit JWT Key + Quota (1 / 5 / 999) 03. LIVE CREDENTIALS DISPATCHED TO OWNER INBOX Instant Access at https://kyorox.com/dashboard
v1.5.0 SECURITY HARDENING • REPLAY & SCHEMA ENGINE

300-Second Atomic Nonce Replay Shield & Deterministic SAML-to-JWT Normalization

  • ✓ 300-Second Atomic Replay Protection: High-speed in-memory SAML Assertion ID deduplication (300s TTL atomic lock) paired with a strict 60-second clock-skew guard, mathematically neutralizing Man-in-the-Middle SAML replay attacks.
  • ✓ Universal Claim Normalization: Automatic volatile RAM mapping of diverse OASIS, WS-Federation, and OID XML schemas into a unified, predictable HS256 signed JWT payload locked strictly to whitelisted allowed_redirect_uris.
  • ✓ Constant-Time API Key Verification: Cryptographic constant-time byte comparison for management API authentication headers to prevent timing side-channel leaks.
ANTI-REPLAY & CLAIM NORMALIZATION v1.5.0
SINGLE-USE ASSERTION ID LOCK (300s TTL) Blocks Replayed SAML Tokens Instantly (HTTP 403) DETERMINISTIC HS256 JWT NORMALIZATION { sub, email, given_name, family_name, roles, idp } ✓ Whitelisted HTTPS Redirect URI Enforcement
v1.0.0 CORE ENGINE LAUNCH • ZERO-PII FOUNDATION

100% Stateless Volatile RAM SAML 2.0 Proxy & AES-256-GCM Secret Vault

  • ✓ Zero-PII Volatile RAM Execution: Engineered the core stateless assertion engine where end-user SAML 2.0 responses are validated in volatile memory (< 12ms) and immediately wiped—writing 0 bytes of employee PII to disk storage.
  • ✓ FIPS-197 AES-256-GCM Authenticated Vault: Hardware-grade authenticated envelope encryption at rest for tenant signing secrets and X.509 certificates using unique 12-byte Initialization Vectors (96-bit IV) and 16-byte GCM integrity tags.
  • ✓ Strict XML Hardening: Pre-parse 64KB payload cap, OWASP XXE external entity blocking, and strict single-assertion DOM pinning against XML Signature Wrapping (XSW) attacks.
CORE ZERO-PII ENGINE ARCHITECTURE v1.0.0
100% VOLATILE RAM EXECUTION (< 12ms) 0 Bytes of End-User PII Written to Disk Forever FIPS-197 AES-256-GCM SECRET VAULT 256-Bit Key + Unique 96-Bit IV + 128-Bit GCM Tag ✓ 64KB Cap + Anti-XXE + Anti-XSW DOM Pinning
CONTINUOUS LIFECYCLE HARDENING

Automated Security Patching & Zero-Downtime Rolling Updates

Between major architectural releases, KyoRox operates a continuous background hardening pipeline—ensuring your enterprise SAML 2.0 gateway stays protected against emerging protocol threats without scheduled downtime.

1. Zero-Downtime Rolling Updates

Because our SAML-to-JWT engine is 100% stateless, runtime security patches and TLS cipher updates deploy seamlessly without dropping active corporate SSO handshakes.

2. Automated Daily Cert Radar

Our background scheduler scans all active tenant X.509 certificates every 24 hours and dispatches proactive 30, 14, and 7-day renewal notices to prevent unexpected SSO outages.

3. Backward-Compatible REST API

All v1 management endpoints (/api/v1/tenants/:id/connections) and standardized HS256 JWT claim schemas maintain strict backward compatibility across releases.