Security is built into every layer of Anoman. This page describes our infrastructure security posture, encryption standards, access controls, and how to report vulnerabilities.

All production workloads run in our Indonesia data center (Jakarta). Our infrastructure:

• Private network with no public-facing database endpoints — all services communicate over private IPs only
• Primary database with hot standby — automatic failover, continuous WAL archiving, point-in-time recovery
• In-memory cache with append-only persistence — private network only, hourly snapshots
• Cluster nodes with per-service IAM roles (least-privilege)
• Workload identity — no long-lived secret files in containers
• Daily encrypted backups to Indonesia-resident object storage, 14-day retention

• TLS 1.3 required for all external connections
• Database storage encrypted at rest (AES-256)
• API keys hashed with bcrypt before storage — raw key shown once at creation and never stored
• Secrets managed via a private secret store — no .env files in production containers

Dashboard access uses a session-based authentication layer with short-lived JWT sessions (1-hour max age). RBAC enforces five roles, checked server-side on every mutating request — not just hidden in the UI:

• Owner — full control: billing, team, every key and policy
• Admin — manage members, API keys, and guardrail policy
• Admin (read-only) — SOC 2-friendly auditor seat: read everything, change nothing
• Member — use the gateway, manage their own keys and policies
• End-user — governed Copilot-only seat: no dashboard, no key minting

The ops dashboard is protected by HTTP Basic Auth in production.

Our incident response process follows a detect → contain → eradicate → recover workflow:

• Automated alerts via our monitoring stack for error rate spikes, SLA breaches, and anomaly detection triggers
• On-call rotation with 15-minute acknowledgement SLA
• Affected customers notified within 72 hours of confirmed breach
• Post-incident reports published on the status page

We operate a responsible disclosure policy. If you discover a security vulnerability, please report it to [email protected] with a description of the issue, steps to reproduce, and potential impact. We acknowledge reports within 48 hours and aim to resolve critical issues within 7 days.