Security
Security is the product. This page summarizes how ContextDataVault protects data and how to report a vulnerability.
Encryption at rest
Section titled “Encryption at rest”- All secret and context‑token content is encrypted with AES‑256‑GCM using per‑vault data keys.
- Data keys are wrapped by HKDF‑derived per‑tenant wrapping keys.
- The master encryption key never leaves the server process. It must be backed up before first run — its loss means permanent, unrecoverable loss of encrypted data.
Access control and audit
Section titled “Access control and audit”- Access is governed by a policy + grant model: time windows, rate limits, and approval gates, scoped per principal.
- Every context‑token and secret‑value access is audited — including denied attempts — in an immutable log.
Isolation
Section titled “Isolation”- Single‑tenant deployments run without multi‑tenant overhead — appropriate for a dedicated instance.
- Multi‑tenant mode adds database row‑level security on top of application‑level scoping for defense in depth.
Transport
Section titled “Transport”Run ContextDataVault behind TLS. Hosted deployments terminate TLS at the edge with automatically managed certificates; require TLS to your database as well.
Reporting a vulnerability
Section titled “Reporting a vulnerability”If you believe you’ve found a security issue, please email support@cybersecuritycyborg.net with details and steps to reproduce. Please do not open public issues for security reports. We aim to acknowledge reports promptly and will keep you updated on remediation.