AES-256-GCM Sessions
Frontend session cookies are symmetrically encrypted using authenticated AES-256-GCM. Raw bearer tokens are never exposed in plaintext.
Encrypted Token Vault
Third-party OAuth credentials for LinkedIn, Meta, X, and Google are encrypted at rest with version-bound application keys.
Tenant Context Isolation
Every database query and API operation enforces mandatory tenant context middleware, preventing cross-tenant data access.
1. Multi-Tenant Architectural Isolation
AIXONICS implements strict logical separation across all enterprise tenants. Incoming API requests must pass through our TenantContextMiddleware, which validates the operator's active organization membership. All relational tables (social accounts, Brand Brain documents, drafts, and execution logs) are strictly partitioned by organization identifier, ensuring that no customer can query or modify another organization's assets.
2. Cryptographic Security & Vault Storage
We apply robust cryptographic standards across storage and transmission:
- Data in Transit: All communication between user browsers, Next.js BFF servers, and the Laravel backend requires TLS 1.2 or TLS 1.3 with modern cipher suites. HSTS (Strict-Transport-Security) with preloading is enforced.
- Session Cookies: Client authentication is managed via encrypted HTTP-only session cookies using authenticated AES-256-GCM. The session payload includes tamper-evident authentication tags; altered or corrupted cookies are cryptographically rejected by the BFF server.
- Credential Encryption at Rest: Third-party OAuth tokens (LinkedIn, Meta, X, Google, Microsoft) and customer-supplied AI keys (BYOK) are encrypted at rest in dedicated database columns using application vault encryption keys with periodic key rotation support.
3. Human-in-the-Loop (HITL) Guardrails
AIXONICS is deliberately architected with deterministic safety barriers. Autonomous execution agents can plan, research, and draft campaigns, but the publishing pipeline enforces a mandatory state transition: AWAITING_APPROVAL. External broadcasting is permanently blocked until an authorized team operator (Manager, Admin, or Owner) explicitly clicks Approve.
4. Application Hardening & Input Sanitization
- XSS Mitigation: Client-rendered HTML (such as email threads or rich drafts) is sanitized using DOMPurify and strict server-side regex tag stripping.
- Rate Limiting & Idempotency: API endpoints enforce token-bucket rate limiters (`throttle` middleware) and require unique idempotency keys on mutating dispatches to prevent duplicate broadcasts.
- Loop Protection: Autonomous agent executions are monitored by a loop protection service that terminates runaway execution paths exceeding maximum allowable steps.
5. Responsible Vulnerability Disclosure Program
We welcome responsible security research from independent practitioners. If you discover a potential security vulnerability in the AIXONICS application, please report it immediately according to our coordinated disclosure guidelines:
Email full proof-of-concept details to security@aixonics.com. Include affected endpoints, step-by-step reproduction instructions, and expected impact.