KYOROX SECURITY & COMPLIANCE CENTER GDPR & CCPA Zero-PII By Design

Zero-PII By Design. Cryptographic Trust at Every Layer.

Most identity providers become a compliance liability by storing your customers' employee records in third-party databases. KyoRox eliminates data residency risk entirely by processing SAML 2.0 assertions strictly in volatile RAM with zero disk persistence.

0 Bytes End-User PII Stored

AES-256-GCM Authenticated Vault

300s Atomic Replay Lock

TLS 1.3 Strict Transport

Architectural Data Boundary

What Touches Volatile RAM vs. What Persists on Disk

Enterprise InfoSec teams approve KyoRox in hours instead of months because we physically separate ephemeral employee assertions from encrypted tenant configuration metadata.

⚡ EPHEMERAL VOLATILE RAM ONLY (WIPED IN < 12ms)

Never Written to Disk or Database Logs

During an enterprise SSO login, employee identity attributes exist exclusively in isolated volatile memory for cryptographic verification and JWT signing, then vanish immediately:

End-User Email Address & Name Claims 0 BYTES ON DISK

Raw SAML 2.0 XML Assertions & Statements 0 BYTES ON DISK

Organizational Group & Role Claims 0 BYTES ON DISK

Transient Signed JWT Handoff Payload 0 BYTES ON DISK

✓ GDPR & CCPA Advantage: Zero employee PII stored means zero third-party data-subject deletion backlog.

🔒 ENCRYPTED CONFIGURATION VAULT (NON-PII METADATA)

Strictly Non-PII Tenant Routing & Key Material

Our persistent configuration vault stores only the non-personal cryptographic parameters required to validate your corporate customers' SAML 2.0 handshakes:

Isolated Tenant Identifier (36-Char UUID v4) ROUTING ID

One-Way SHA-256 Hashed API Key Digest NO PLAINTEXT

AES-256-GCM Encrypted JWT Signing Secret 96-BIT IV + TAG

IdP Entity ID, SSO URL, Redirects & X.509 Cert AES-256-GCM

✓ Envelope Integrity: Every secret is sealed with a unique 96-bit IV and 128-bit GCM authentication tag.

Cryptographic Defense-in-Depth

Six Verifiable Enterprise Security Controls

Every authentication request and management API call is protected by deterministic, industry-standard cryptographic primitives.

FIPS-197 AES-256-GCM

AES-256-GCM Secret Encryption

Tenant JWT signing secrets and uploaded IdP X.509 certificates are sealed using 256-bit Galois/Counter Mode encryption with unique 96-bit initialization vectors and 128-bit integrity tags.

TAMPER PROTECTION 128-BIT AUTH TAG

SHA-256 + CONSTANT-TIME

One-Way Key Hashing & Constant-Time Auth

Live API keys (kyx_live_...) are hashed irreversibly using SHA-256 and verified via constant-time byte comparison to neutralize cryptographic timing side-channels.

PLAINTEXT KEYS STORED ZERO (HASH ONLY)

300s ATOMIC NONCE LOCK

300-Second Atomic Nonce Replay Shield

Every incoming SAML Assertion ID is atomically locked in volatile memory for 300 seconds, mathematically blocking assertion replay and man-in-the-middle capture attacks.

ASSERTION REUSE BLOCKED (HTTP 403)

RSA-SHA256 + ANTI-XSW

Strict X.509 RSA-SHA256 Signature Pinning

Every SAML response is structurally pinned against XML Signature Wrapping (XSW) and cryptographically verified against the tenant's X.509 certificate before any claim is extracted.

XXE & XSW VECTORS NEUTRALIZED

STRICT URI WHITELIST

Redirect URI Whitelisting & Payload Guard

Token handoffs are locked strictly to pre-authorized HTTPS allowed_redirect_uris to prevent open-redirect token interception, backed by automated Zero-PII payload guards.

OPEN REDIRECT RISK ELIMINATED

ZERO BROWSER COOKIES

Cookie-Free Ephemeral Control Plane

The Customer Control Plane operates exclusively via tab-scoped sessionStorage—zero persistent browser cookies, zero tracking scripts, and instant session destruction on tab close.

PERSISTENT COOKIES 0 SET BY GATEWAY

Procurement & InfoSec Due Diligence

Interactive Enterprise Security Questionnaire Explorer

Select any topic below to inspect KyoRox's standardized architectural responses for enterprise security, privacy, and procurement reviews.

TOPIC 01 • GDPR, CCPA & DATA RESIDENCY

Stateless Cryptographic Conduit — Not a PII Data Warehouse.

Because KyoRox never writes authenticating employee emails, names, or directory roles to persistent disk or log files, no end-user PII resides at rest on our servers. This eliminates cross-border PII storage friction and simplifies GDPR/CCPA Data Processing Agreements.

PROCUREMENT VERIFICATION SUMMARY

Sub-processor PII storage scope: 0 Bytes. Right-to-erasure (RTBF) compliance is instantaneous by design because employee records are never persisted.

INFOSEC QUESTIONNAIRE RESPONSE BLOCK

[VENDOR SECURITY QUESTIONNAIRE — DATA PRIVACY & RESIDENCY]
------------------------------------------------------------
Q: Does the vendor store end-user PII (emails, names, roles)?
A: NO (0 Bytes). SAML 2.0 assertions are verified and converted
   into signed HS256 JWTs strictly in volatile RAM (<15ms).

Q: How long are end-user authentication payloads retained?
A: 0 seconds on disk. Volatile memory buffers are immediately
   dereferenced upon dispatching the HTTP 302 callback redirect.

Q: Are authentication logs scrubbed of sensitive attributes?
A: YES. Automated runtime redaction masks prevent any user
   email, NameID, or token from entering diagnostic output.

Official Governance & Policies

Compliance & Legal Transparency Directory

Direct access to our published security architecture, zero-PII privacy commitments, terms of service, and real-time gateway telemetry.

Security Policy

Detailed breakdown of our TLS 1.3 transport security, XXE/XSW XML defenses, AES-256-GCM secret vault, and vulnerability disclosure protocol.

Read security.html →

Privacy & Zero-PII Policy

Formal legal verification of our 100% volatile RAM SAML processing lifecycle, cookie-free gateway endpoints, and GDPR/CCPA alignment.

Read privacy.html →

Terms of Service

Commercial licensing terms, acceptable use guidelines, subscription tier quotas, and service level commitments for B2B SaaS tenants.

Read terms.html →

Live System Telemetry

Real-time browser health ping against sso.kyorox.com, P99 volatile RAM verification benchmarks, and 90-day component uptime radar.

Open status.html →

DNS-Verified GitHub & Verifiers

Inspect our DNS-verified GitHub organization (Kyorox-official) and zero-dependency Node.js & Python HS256 JWT verification repositories.

Open github.com/Kyorox-official ↗

Public Trustpilot & Directory Footprint

Verify KyoRox's domain ownership and public footprint across Trustpilot, LinkedIn, Dev.to, X (@kyorox_official), and SaaSHub.

View Trustpilot Profile ↗