Security

A full security whitepaper is forthcoming. Highlights of how the platform is built:

• Authentication and authorization. API access is via JWT bearer tokens issued by the Auth service; every service enforces authorization at its own boundary, including on MCP tool calls.
• Tenant isolation. Services are multi-tenant with tenant-scoped data access; storage services isolate tenant files.
• Transport. Lower environments accept plain HTTP for local development only; production deployments terminate TLS at the edge.
• Data handling. The platform includes dedicated services for PII scrubbing and privacy-conscious processing; see the service catalog for details.
• Reporting. If you believe you have found a vulnerability, email info@InayaLabs.com rather than opening a public issue. We will acknowledge reports promptly.