Legal
Security
How to report vulnerabilities and what we protect in the Aegis platform.
Salanor builds Aegis as a signed provenance layer for production AI agents. We treat security reports from customers and researchers as part of operating the product, not as a distraction.
Report a vulnerability
Email security@salanor.com with:
- A clear description and impact assessment
- Steps to reproduce on the latest production or stated pilot environment
- Your preferred contact and disclosure timeline
For coordination without exposing details in email, use the contact form with topic Security disclosure and ask for encrypted follow-up.
Automated tools should read /.well-known/security.txt (RFC 9116).
What we protect
- Integrity of APS-1 events: Ed25519 signatures, per-agent hash chains, and Merkle transparency proofs (60s witness worker)
- BYOK signing: Customer registers public keys; private keys stay in your KMS, HSM, or agent runtime. Optional AWS/GCP KMS Sign for server-side paths.
- Tenant isolation: organization-scoped data paths in API and console
- Authentication: password hashing, session cookies, OAuth and enterprise SSO where enabled
- Operational access: Platform Ops actions audited; production access on a least-privilege basis
- SIEM forwarding: OTLP log export to Splunk, Datadog, Microsoft Sentinel
Architecture summary (whitepaper)
Data flow: Agent or workflow bridge signs APS-1 events client-side (BYOK). API verifies signature against registered public key, persists hash-chained rows, evaluates policy, and optionally notifies approvers. Witness worker batches Merkle roots every 60 seconds. Compliance exports package events + control mapping + witness proofs as ZIP.
What Salanor cannot do: For customer-held BYOK keys, we cannot forge events or rewrite history without your private key. We can deny ingest for invalid signatures or policy violations.
Subprocessors: Hosting (Railway, Vercel), Postgres (Neon), email (Postmark/Resend). See privacy policy for current list.
Out of scope
Clickjacking on marketing pages without demonstrated impact, missing security headers without exploit, and social engineering are generally out of scope. Do not test against customer tenants you do not own.
Safe harbor
We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure. We do not operate a paid bug-bounty program during the design-partner phase; we acknowledge valid reports within five business days when possible.