Security model

Mnemontron is designed so that a stolen password, a stolen disk or another tenant cannot reach your evidence. Everything on this page is implemented and tested in our development environment. It has not been audited by a third party, and there is no production deployment yet.

Sign-in

• Passkeys only. Sign-in uses WebAuthn passkeys with user verification required. Password-only sign-in is disabled. Optional second factors (TOTP or a password) can only be added after a passkey assertion, never used alone.
• Step-up re-authentication. Export, deletion, role changes, federation changes and key rotation require a fresh passkey check.
• Short sessions. Human access tokens last at most 15 minutes and refresh tokens are single-use. Agents get separate, scoped, revocable tokens.

Data protection

• Envelope encryption. Every locally preserved evidence blob is sealed with AES-256-GCM using a per-tenant data key, which is itself wrapped by a master key. Backups are sealed the same way.
• Tenant isolation. Postgres row-level security scopes every query to the current tenant, on top of membership checks. Tests cover cross-tenant reads by hash and cross-tenant leakage through search snippets.
• Rights enforcement. Revoking a source removes it from search and vector indexes and caches, and retrieval drops revoked material at query time as a second line of defense.

Integrity and audit

• Content addressing. Evidence is identified by its BLAKE2b hash, so any change to the bytes changes the identity.
• Hash-chained audit log. Each audit entry is chained to the previous one, and the chain head is periodically signed and written to write-once storage, so deleting or editing rows is detectable.
• Signed receipts. Query and citation receipts are Ed25519-signed and carry a nonce and an expiry (one hour by default). Presenting the same receipt twice is flagged as a replay, and expired receipts are rejected.

Hardening

• Hostile-file defenses: size limits, magic-byte checks, and PDF and OCR parsing in a sandboxed subprocess. Tests cover zip bombs, zip-slip, nested archives, XML entity expansion and scripted SVG.
• Server-side request forgery guards on outbound fetches, rate limits and lockout on sign-in, strict security headers, and hash-pinned dependencies.
• A standing red-team suite runs attack tests for prompt injection in ingested content, compromised tool outputs, poisoned federation imports, receipt forgery and replay, and cross-tenant leakage. The latest internal run passed all 13 tests.

Not done yet

• No third-party penetration test or security audit.
• No production or multi-region deployment.
• No signed release pipeline.