Security Infrastructure

CustomKeys is built with a security-first architecture. We treat your data with the highest level of protection.

1. Encryption at Rest

All sensitive data is encrypted using AES-256-GCM. Encryption keys are managed using a secure key rotation policy.

2. Encryption in Transit

All data sent between your client and our servers is encrypted using TLS 1.3. We use HSTS to ensure browsers only connect via HTTPS.

3. Secure Enclave

Our backend logic for secret derivation runs in an isolated environment. We use industry-standard practices to prevent side-channel attacks and unauthorized access.

4. Multi-Factor Authentication (MFA)

We support and encourage the use of MFA for all users. We integrate with Supabase Auth to provide robust TOTP and WebAuthn options.

5. Audit Logging

Every action taken within your organization is logged. These logs are immutable and can be used for compliance and security auditing.

6. Responsible Disclosure

If you think you've found a security vulnerability in CustomKeys, please report it to us immediately at security-customkeys@meuhan.resend.app.