SECURITY
Security at WardenAuth
An authorization service has to be honest about its own security. This page lists what is in place today, what is in progress, and how to reach us about a vulnerability.
Compliance status
| Area | Status | Detail |
|---|---|---|
| SOC 2 | In progress | Controls in place and documented; certification not yet achieved. |
| HIPAA | Not yet | Technical controls exist (encryption, Object Lock, audit). No formal attestation and no BAA yet. |
| GDPR | In place | Data processing agreement available on request. PII is redacted in audit events. |
| Hosting | In place | AWS us-east-1 (N. Virginia), single region. Multi-region is on the roadmap. |
Controls in place
- Immutable audit trail: HMAC-signed events, cold archive under S3 Object Lock, point-in-time recovery
- Encryption in transit (TLS 1.2+, HSTS) and at rest (AWS KMS, SSE)
- API keys stored as HMAC-SHA256 hashes with a server-side pepper; scoped, rotatable, shown once
- SSO with SAML and OIDC; SCIM 2.0 provisioning
- IP allowlists per organization, enforced on management API calls
- Separation of duties and approval workflows, with self-approval blocked
- AWS WAF on the API and the sites, with rate limiting
- Signed webhooks with retries; signed, verifiable permission receipts
- Hourly anomaly detection on access spikes and denial patterns
Subprocessors
| Company | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage, email, identity (Cognito) | us-east-1 |
| Stripe | Payments and subscriptions | Global |
The DPA and the full subprocessor list are available on request from hello@wardenauthz.com.
Report a vulnerability
Email security@wardenauthz.com with the affected component, steps to reproduce and the impact. Please don't open public issues for undisclosed vulnerabilities. We credit reporters after the fix, if they wish.
- Acknowledgement
- within 24 hours
- Initial triage
- within 72 hours
- Plan for high or critical
- within 5 business days
Live service status is on the status page.