# Security model Mnemontron is designed so that a stolen password, a stolen disk or another tenant cannot reach your evidence. Everything on this page is implemented and tested in our development environment. It has not been audited by a third party, and there is no production deployment yet. ## Sign-in - **Passkeys only.** Sign-in uses WebAuthn passkeys with user verification required. Password-only sign-in is disabled. Optional second factors (TOTP or a password) can only be added after a passkey assertion, never used alone. - **Step-up re-authentication.** Export, deletion, role changes, federation changes and key rotation require a fresh passkey check. - **Short sessions.** Human access tokens last at most 15 minutes and refresh tokens are single-use. Agents get separate, scoped, revocable tokens. ## Data protection - **Envelope encryption.** Every locally preserved evidence blob is sealed with AES-256-GCM using a per-tenant data key, which is itself wrapped by a master key. Backups are sealed the same way. - **Tenant isolation.** Postgres row-level security scopes every query to the current tenant, on top of membership checks. Tests cover cross-tenant reads by hash and cross-tenant leakage through search snippets. - **Rights enforcement.** Revoking a source removes it from search and vector indexes and caches, and retrieval drops revoked material at query time as a second line of defense. ## Integrity and audit - **Content addressing.** Evidence is identified by its BLAKE2b hash, so any change to the bytes changes the identity. - **Hash-chained audit log.** Each audit entry is chained to the previous one, and the chain head is periodically signed and written to write-once storage, so deleting or editing rows is detectable. - **Signed receipts.** Query and citation receipts are Ed25519-signed and carry a nonce and an expiry (one hour by default). Presenting the same receipt twice is flagged as a replay, and expired receipts are rejected. ## Hardening - Hostile-file defenses: size limits, magic-byte checks, and PDF and OCR parsing in a sandboxed subprocess. Tests cover zip bombs, zip-slip, nested archives, XML entity expansion and scripted SVG. - Server-side request forgery guards on outbound fetches, rate limits and lockout on sign-in, strict security headers, and hash-pinned dependencies. - A standing red-team suite runs attack tests for prompt injection in ingested content, compromised tool outputs, poisoned federation imports, receipt forgery and replay, and cross-tenant leakage. The latest internal run passed all 13 tests. ## Not done yet - No third-party penetration test or security audit. - No production or multi-region deployment. - No signed release pipeline.