Security
Security Overview
Comprehensive security architecture, threat model, dual-key credential separation, and data protection standards.
Overview
The Asiyst Security Architecture is designed around zero-trust principles, cryptographic data isolation, and a strict dual-key security model. Public SDK credentials can safely run in browser bundles, while administrative capabilities remain locked behind private backend API keys.
The Dual-Tier Credential Model
┌─────────────────────────────────────────────────────────────┐
│ Client Browser │
│ Uses Public Key (pk_live_...) │
│ - Mount assistant widget │
│ - Transmit visitor messages │
│ - Guarded by Allowed Domains whitelist │
└──────────────────────────────┬──────────────────────────────┘
│ HTTPS / TLS 1.3
▼
┌─────────────────────────────────────────────────────────────┐
│ Asiyst Edge Gateway │
│ - Evaluates Origin & Referer headers │
│ - Issues ephemeral 24h JWT session token │
└──────────────────────────────┬──────────────────────────────┘
▲
│ HTTPS / TLS 1.3
┌──────────────────────────────┴──────────────────────────────┐
│ Backend Server / CI/CD │
│ Uses Secret Key (sk_live_...) │
│ - Full administrative CRUD on projects & knowledge │
│ - Manage billing, webhooks, and team access │
└─────────────────────────────────────────────────────────────┘
Threat Model & Mitigations
| Threat Vector | Potential Impact | Asiyst Mitigation Strategy |
|---|---|---|
| Public Key Scraped from HTML | Attacker attempts to use your key on their site | Gateway checks Origin header; requests from non-whitelisted domains are rejected with HTTP 403. |
| Prompt Injection Attacks | Visitor attempts to override system prompt rules | Strict delimiter parsing, contextual output filtering, and anti-jailbreak safety layers. |
| Eavesdropping / Man-in-the-Middle | Interception of conversational tokens | All traffic strictly requires TLS 1.3 or TLS 1.2 with HSTS enforced. |
| Data Exfiltration | Unauthorized extraction of knowledge base documents | Vectors are partitioned in isolated tenant databases with row-level security (RLS). |
Encryption at Rest & in Transit
- In Transit: All API, WebSocket, and CDN traffic is encrypted with TLS 1.3 using modern AEAD ciphers (AES-GCM / ChaCha20-Poly1305).
- At Rest: PostgreSQL databases, vector indices, and S3 file stores are encrypted using AES-256 with keys managed in AWS / GCP Hardware Security Modules (HSMs).
- Secret Vault: Provider API keys (OpenAI, Anthropic) are encrypted with envelope encryption via Supabase Vault.
Compliance & Certifications
Asiyst adheres to major international privacy frameworks:
- SOC 2 Type II: Audited annual compliance covering Security, Availability, and Confidentiality.
- GDPR & CCPA: Full compliance with data minimization, right to erasure, and zero foundation model training on customer data.