Security

Authentication

Every sign-in uses a password plus a second factor. WebAuthn passkeys (hardware or platform) are mandatory for owner/admin roles. Sessions are stored in the database and can be revoked individually.

Step-up authentication

Sensitive actions (webhook secret rotation, withdrawals, enrolling a new passkey) trigger an additional WebAuthn challenge. No critical action proceeds without hardware-backed confirmation.

Encryption

TLS 1.3 everywhere. Data at rest is encrypted with AES-256-GCM. Keys live in HashiCorp Vault on our bare-metal stack. Quarterly rotation, annual audit.

Signed webhooks

HMAC-SHA256 over the raw request body. Anti-replay timestamp. One-click secret rotation with a 24-hour grace period. Exponential retries (5 attempts over 24 h), inspectable dead-letter queue from the backoffice.

Infrastructure

Bare metal in France (HostMyServers — Lyon, Paris and Annecy datacenters). Redundant multi-carrier network, DDoS mitigation, 99.99% SLA. No US cloud, no AWS, no GCP. Zero foreign dependency.

Bug bounty program

We reward responsible disclosure. Report a vulnerability to security@abyxo.app and we will come back to you with the scope, the rules and the reward for your report.

Audits

• Annual external pentest (Synacktiv).
• SOC 2 Type II — audit Q4 2026.
• Halborn audit — gRPC runtime adapter.