# Security — EternalEngine

Security built into every layer. Learn how EternalEngine protects your data with encryption, tenant isolation, access controls, and secure infrastructure.

Security

# Security built into every layer

From encryption and tenant isolation to access controls and infrastructure hardening, EternalEngine is designed with a security-first architecture. Your data is protected at every stage of its lifecycle.

## Data Encryption

Every connection to EternalEngine uses TLS 1.3 to protect data in transit. Backups and cold-storage archives are encrypted (X25519/age, restic), and secrets live in an encrypted vault — never in code or config.

- Encrypted secrets vault — nothing in code or config
- TLS 1.3 in transit
- Encrypted backups and archives

## Tenant Isolation

Every organization operates in a completely isolated environment with row-level security enforced at the database level. No cross-tenant data access is possible.

- Row-level security (RLS) enforcement
- Strict data boundaries
- Zero cross-tenant access

## Access Controls

Granular role-based permissions control exactly what each user can see and do. Every action is logged for complete audit trails and compliance.

- Role-based access control (RBAC)
- JWT authentication tokens
- Complete audit trails

## Secure Infrastructure

EternalEngine runs on hardened infrastructure with containerized services, network segmentation, and automated daily backups with point-in-time recovery.

- Docker containerization
- Network segmentation + edge WAF (Cloudflare)
- Automated daily backups

## Secure Development

Every change runs a gauntlet before it ships. No code reaches production without passing automated security analysis — there are no exceptions and no overrides.

- Static analysis (CodeQL + Semgrep) on every change
- Dependency review, vulnerability audit + secret scanning
- Signed commits + protected release branch

## Trust Nothing by Default

Every external input is schema-validated before it touches business logic, and every database query is parameterized. Injection is treated as a design impossibility, not a bug class to chase.

- Schema validation (Zod) on all external inputs
- Parameterized SQL only — no string interpolation
- Deny-by-default authentication on every endpoint

## Engineering Governance

Every change ships through an automated gate in the build pipeline that enforces our engineering rules — tenant isolation from the auth context only, parameterized queries, validated inputs, no secrets in code or logs, structured audit logging — rather than relying on good intentions.

- Aligned to OWASP ASVS + NIST SP 800-218 (SSDF)
- Software bills of materials + build provenance
- Structured audit logging — no secrets, no PII in logs

Response

## Vulnerability response targets

When a vulnerability is confirmed, the clock starts. These are the internal remediation targets our engineering process is built around.

| Severity | Remediation target |
| --- | --- |
| Critical | 24 hours |
| High | 72 hours |
| Medium | 7 days |
| Low | 30 days |

**Found something?** We welcome coordinated disclosure from security researchers. Email[info@eternalengineos.io](mailto:info@eternalengineos.io?subject=Security%20vulnerability%20report)with reproduction steps — good-faith research through this channel will never be met with legal action.

## Compliance & Standards

Honesty over badges: we engineer against OWASP ASVS and NIST SP 800-218 today, our GDPR program is in progress, and formal certifications are on the roadmap. We will never display a certification we haven't earned — when these flip to "certified," it will be real.

OWASP ASVS · AlignedNIST SSDF · AlignedGDPR · In ProgressSOC 2 Type II · RoadmapISO 27001 · Roadmap

## Questions about security?

Our team is happy to discuss our security practices, infrastructure architecture, or compliance roadmap in detail. The commitments in writing: the [Data Processing Agreement](https://eternalengineos.io/dpa/), the [Privacy Policy](https://eternalengineos.io/privacy/), and every request you can make on[Your Data & Requests](https://eternalengineos.io/data-requests/).

[Contact our security team](https://eternalengineos.io/contact/)