SOC 2 Compliance Primitives.
A system layout mapping our infrastructure directly to the AICPA Trust Services Criteria for Security, Availability, and Confidentiality.
Tenant resources are isolated through API key evaluation (authenticateDeveloperKey). Secret access keys are generated using Node's native crypto.randomBytes and stored as one-way hashes in PostgreSQL, so the original secret is not stored in plaintext.
Our email dispatch layer includes provider failover logic. The DeliverabilityEngine can shift transaction routes between configured delivery providers, including AWS SES and Postmark, when defined delivery or availability conditions are met.
Verification checks are processed within transient application memory. The authepy_api_logs table records operational metadata such as timestamps, IP addresses and success/failure status according to the applicable retention policy. OTP values themselves are not written to application monitoring logs.