Enterprise Security Policy & Cryptographic Architecture.

1. Enterprise Security Philosophy & Defense-in-Depth Architecture

KyoRox ("KyoRox", "we", "us", or "our") operates mission-critical identity federation infrastructure connecting enterprise SAML 2.0 Identity Providers to modern B2B applications. Our security engineering philosophy is built on a simple principle: the most secure end-user personal data is data that is never written to persistent storage.

This Enterprise Security Policy documents the technical safeguards protecting our production SAML 2.0 to JWT gateway (https://sso.kyorox.com), the Customer Control Plane (https://kyorox.com/dashboard), and our public platform (https://kyorox.com).

2. Zero-PII Volatile RAM Execution Boundary

To eliminate data-at-rest breach liability for enterprise authentication traffic, KyoRox processes all incoming SAML 2.0 assertions strictly inside volatile system RAM:

• Ephemeral In-Memory Transformation (<12ms): When an employee authenticates via Okta, Microsoft Entra ID, Google Workspace, JumpCloud, PingIdentity, or Custom SAML 2.0, KyoRox verifies the cryptographic XML signature and maps user attributes (NameID, email, firstName, lastName, and group roles) into an RFC 7519 HS256 JWT entirely in volatile memory.
• Zero Disk Persistence: Immediately following the HTTP redirect handoff to the customer's whitelisted callback URI, the memory buffer is garbage-collected. KyoRox writes 0 bytes of end-user PII to database tables or persistent log files, enforced by automated Zero-PII payload redaction guards.

3. Cryptographic Standards (In-Transit & At-Rest Vault)

All administrative credentials, signing secrets, and network traffic are protected by industry-standard cryptographic primitives:

• Transport Security (In-Transit): All public web pages, Control Plane API endpoints, and SAML 2.0 Assertion Consumer Service (ACS) routes enforce strict HTTPS / TLS 1.3 encryption with HTTP Strict Transport Security (HSTS) preload headers, X-Frame-Options: DENY, and strict Content Security Policy (CSP) rules.
• Authenticated Secret Vault (At-Rest): Tenant 256-bit JWT signing secrets (client_secret) and uploaded IdP X.509 certificates are encrypted at rest using FIPS-197 256-bit AES-256-GCM (Galois/Counter Mode) authenticated encryption with a unique per-record 96-bit (12-byte) Initialization Vector (IV) and a 128-bit (16-byte) cryptographic authentication tag.
• Deterministic JWT Signing: Downstream authentication tokens are signed using HS256 (HMAC-SHA256) with the tenant's isolated 256-bit secret and a strict 300-second expiration window.

4. Zero-Trust API Key Hashing & Constant-Time Authentication

Tenant Live API Keys (kx_live_...) used to authenticate Control Plane requests are never stored in plain text or reversible encrypted form:

• Irreversible SHA-256 Digest Storage: Only a one-way SHA-256 cryptographic hash digest of the API key is persisted. If a customer misplaces their key, it cannot be read back and must be rotated via email OTP verification.
• Constant-Time Verification: Every incoming administrative request header (x-api-key) is hashed in memory and compared against the stored digest using constant-time byte comparison to neutralize cryptographic timing side-channel attacks.

5. SAML 2.0 Protocol Hardening (XXE, XSW & X.509 Signature Pinning)

Because XML-based authentication protocols are frequent targets of structural manipulation, KyoRox enforces strict pre-parse and post-parse XML security shields:

• Pre-Parse XXE & DTD Rejection: All incoming SAML XML payloads are capped at 64KB and pre-screened before parsing. Any payload containing <!DOCTYPE or <!ENTITY declarations is immediately rejected to block XML External Entity (XXE) injection and Billion Laughs entity expansion attacks.
• X.509 RSA-SHA256 Signature Pinning & XSW Mitigation: SAML assertions are verified strictly against the tenant's pinned IdP X.509 certificate using RSA-SHA256, with canonical node pinning that prevents XML Signature Wrapping (XSW) and comment-injection spoofing.

6. 300-Second Atomic Nonce Replay Shield & Redirect URI Whitelisting

KyoRox enforces strict temporal and destination locks on every authentication transaction:

• 300-Second Atomic Nonce Lock: Every consumed SAML AssertionID is atomically locked in volatile memory with a strict 300-second (5-minute) TTL. Any attempt to replay a captured SAML response within its validity window is rejected immediately.
• Strict HTTPS Redirect URI Whitelisting: KyoRox never performs open redirects. Signed JWT handoffs are dispatched exclusively to exact HTTPS callback URLs pre-registered in the tenant's allowed_redirect_uris whitelist.

7. Control Plane Security, Email Verification & Self-Serve Key Rotation

The Customer Control Plane (https://kyorox.com/dashboard) is engineered with strict browser and credential lifecycle protections:

• Cookie-Free Tab-Scoped Custody: Active workspace credentials are held exclusively inside browser tab-scoped window.sessionStorage (never in persistent localStorage or browser cookies) and are automatically destroyed the moment the browser tab is closed.
• Email Verification & Credential Recovery: Misplaced credentials cannot be read back from storage. The Control Plane provides a built-in ownership verification flow that dispatches a time-bound 6-digit One-Time Passcode (OTP) to your registered billing email address prior to authorizing recovery.
• 1-Click Atomic API Key & Secret Rotation: Verified workspace administrators can trigger instant atomic key rotation inside the Control Plane, immediately invalidating old API keys and issuing a fresh 256-bit JWT Client Secret.
• Proactive X.509 Certificate Expiry Radar: KyoRox continuously monitors the expiration timestamp (validTo) of every pinned IdP X.509 certificate and dispatches automated 30, 14, and 7-day renewal alerts to prevent unexpected SSO outages.

8. Logical Multi-Tenant Isolation & Rate Limiting

Every customer workspace is logically isolated across all administrative and authentication routes:

• Composite Anti-IDOR Isolation: Every configuration read, update, or deletion query enforces strict composite ownership checks binding both the authenticated Tenant UUID (UUID v4) and the target connection identifier, preventing Insecure Direct Object Reference (IDOR) cross-tenant access.
• Tier-Enforced Connection Quotas: Connection limits are cryptographically enforced per subscription tier (Starter: 1 IdP, Growth: 5 IdPs, Enterprise: 999 IdPs).
• Payload Sanitization & Edge Rate Limiting: All administrative and authentication endpoints enforce strict schema validation, XSS-safe DOM rendering, and automated rate limiting to defend against credential stuffing and brute-force enumeration.

9. Payment Security, Webhook HMAC Verification & Merchant of Record

All subscription checkouts, payment card processing, and indirect tax compliance (VAT / GST / Sales Tax) are handled directly by our PCI-DSS Level 1 compliant Merchant of Record, Lemon Squeezy (see our Refund & Tax Policy):

• Zero Payment Card Storage: KyoRox never touches, processes, or stores credit card numbers or banking credentials.
• Cryptographic Webhook HMAC Verification: All automated tenant provisioning, quota upgrade, and refund revocation webhooks from Lemon Squeezy are verified using constant-time HMAC-SHA256 payload signature validation prior to execution.

10. Responsible Vulnerability Disclosure Policy & Safe Harbor

KyoRox welcomes collaboration with independent security researchers and enterprise InfoSec teams to maintain the highest security standards:

• How to Report a Vulnerability: If you discover a potential security vulnerability in kyorox.com or sso.kyorox.com, please email a detailed technical report and reproduction steps directly to support@kyorox.com with the subject line "Security Vulnerability Report".
• 24 to 36 Hour Triage SLA: Our systems engineering team acknowledges and triages all legitimate vulnerability reports within 24 to 36 hours.
• Rules of Engagement & Prohibited Testing: Researchers must not perform Denial-of-Service (DoS/DDoS) attacks, automated high-volume scanning, social engineering/phishing against KyoRox personnel or customers, or attempt to access or modify another tenant's workspace configuration.
• Good-Faith Safe Harbor: KyoRox will not pursue legal action against researchers who discover and report vulnerabilities in good faith in accordance with this policy.

11. Security Desk Contact & Governance Directory

For enterprise security questionnaires, architecture verification, or urgent incident reporting, contact our Security & Systems Engineering Desk directly.