What protects your data,
and how.
Security copy usually describes a feeling. This page describes mechanisms: which key encrypts what, who holds it, where the tenancy boundary is enforced, and which claims we have not earned yet. If something here is vague, assume we could not verify it and ask us.
Continual internal audits, with the report on request. The controls, and how to check them.
The Controls, Named
Each of these is a decision in code you can point at, not a posture.
Encryption at Rest and in Transit
At rest, every tenant's data sits under a key derived for that tenant alone and sealed with AES-256-GCM, and backups are encrypted with age, which carries a post-quantum option. In transit it is TLS 1.3, and the edge offers hybrid ML-KEM-768 key exchange, so traffic captured today is not readable by a quantum computer later.
Second Factors
An authenticator app, a code by SMS or email, or a passkey. Enrolment hands out the material and demands it back before it writes anything, and adding or dropping a factor signs the account out of every other browser — a stolen session that outlives the change is the same as not having the factor.
Keys and Tokens
A key is told apart from a token by its prefix, so nothing has to guess what it was handed. Tokens are refused outright if they carry an HMAC signature or no algorithm at all, and a refresh token is single-use — presenting a spent one revokes its whole family rather than the one token.
Who May Reach What
Access is a grant at a place: an organization, a workspace under it, a project under that. A check asks whether some grant the caller holds covers the path and admits the verb. One rule, no special cases, and the decision is a function call rather than a service that can be down.
The Edge Throws Identity Away
Anything that arrives claiming to be an org, a user or an email is deleted at the gateway before a single handler reads it. Identity is written back only from a verified token. Inside the cluster, services reach each other over a binary protocol rather than the public internet.
Where It Sits
An organization is a tenancy boundary, and on Hanzo Base it is a physical one — a different organization is a different database file, opened under a different key, so no query can reach across two. Dedicated and self-hosted deployments pin that file to a region you choose.
What runs underneath
Workloads sit in hardware-virtualised machines on managed Kubernetes, in data centres with physical access control and redundant power. Secrets never reach a manifest — they are fetched from Hanzo KMS at boot, and outside development a service refuses to start without a verified issuer, audience and key set rather than falling back to running open.
Or none of our infrastructure at all
Every piece named on this page is a binary you can run yourself. The strongest answer to a question about our infrastructure is that you do not have to use it.
What comes with Enterprise
An engineer who has read your deployment, retention you set rather than inherit, and somebody to answer the questionnaire your procurement team is about to send.
If you are the one who has to sign off
Bring the control you are required to demonstrate and we will show you the code that implements it, or tell you plainly that it does not exist yet. A control we cannot point at is one you should not put your name to.
Where a requirement is not met, the honest options are usually self-hosting, a dedicated deployment, or waiting. Our engineers will say which one applies rather than selling you the gap.
Found something
Email us rather than opening a public issue, and include a reproduction if you have one. A real report from a stranger is worth more than an internal review, and we answer quickly.
[email protected]Ask us the hard question
Bring the requirement you cannot get past, and we will show you the code or tell you it is not built. Both answers are more useful than a brochure.