Built for the keys to your kingdom.

Private keys generated for certificate signing requests are encrypted with AWS KMS before they ever touch the database. Each ciphertext is bound to your organization with an encryption context, so a leaked row can't be decrypted out of tenant.

The .p8 you paste into HexSign is written to AWS Secrets Manager bound to a HexSign-owned KMS key, not the AWS-managed default. Disabling that key in an incident makes every Apple secret unreadable atomically, and every decrypt is logged in CloudTrail.

Postgres uses AES-256 storage encryption keyed off a customer-managed KMS CMK with annual key rotation. Automated backups, snapshots, and point-in-time recovery inherit the same key, and deletion protection is enabled on the production cluster.

The database parameter group enforces require_secure_transport=ON. Any client that forgets to opt in is rejected at the handshake. Lambda always negotiates TLS to RDS.

We don't keep .p12 files lying around. When you download a certificate, the private key is decrypted in-memory, packaged into a P12 with a freshly generated one-time password, and streamed to you. Nothing is persisted server-side.

Postgres lives in private subnets with no public IP. The API runs in the same VPC and reaches the database over an internal security group with TLS. There is no route from the internet.

The API rejects requests from unknown origins and never returns Access-Control-Allow-Origin: *. Browser clients are limited to dashboard.hexsign.net, hexsign.io, and known development origins.

All traffic terminates at API Gateway over HTTPS. Calls to App Store Connect are signed with ES256 JWTs from your decrypted .p8, generated per request and cached in-memory only.

Every read and write is scoped by your organization id at the repository layer. Cross-tenant access requires bypassing the database access layer, not just guessing an id.

AWS WAF runs the AWS Common Rule Set, Known Bad Inputs, SQLi, and Anonymous IP rules on every request. Authentication, signup, and credential issuance routes carry tighter ceilings than read paths.

Rate-based rules cap both per-IP and per-bearer-token request volume in tight windows. A leaked token can't scrape your account at line rate, and a single IP can't hammer auth or signup.

Multi-factor authentication is on by default at the user pool level. Users can register an authenticator app or fall back to SMS, and add or revoke factors from their account settings.

Passwords require lowercase, uppercase, numbers, and symbols, with a minimum length enforced at the identity provider, not the application, so the rule can't be bypassed by API calls.

New accounts must verify their email before they can sign in. Phone numbers, when used, are verified before they can be relied on for SMS MFA or recovery.

Owner, Admin, and Member roles gate billing, user management, CLI token issuance, and write actions. Role checks are enforced server-side on every privileged route. The dashboard's UI hiding is just a courtesy.

Every sign-in, MFA challenge, password change, and risk decision is recorded with IP, device, and geo. You can review your own activity from settings; admins can review their team's.

Signing out of the dashboard performs a global sign-out, which invalidates the refresh token at the identity provider, not just the local session, so a stolen device can't keep refreshing.

The dashboard ships with a CSP that allowlists exactly the origins it talks to (HexSign API, Cognito, and the icon CDN), blocks framing entirely, and disables inline event handlers and arbitrary plugin content.

Every response sets Strict-Transport-Security with a two-year max-age, includeSubDomains, and the preload flag. After a browser sees the header once, downgrades to HTTP are physically impossible.

X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, and a Permissions-Policy that blocks camera, microphone, geolocation, payment, and USB by default.

Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy are set so the dashboard window can't be probed by a hostile opener and its resources can't be embedded by other origins.

A SameSite=Strict, Secure cookie pairs with an X-CSRF-Token header on every state-changing route. Constant-time comparison rejects mismatches. Defense-in-depth on top of Bearer-only auth.

The dashboard ships with zero session-replay, analytics, or marketing pixels. Your team's browsing of certificates, profiles, and CSRs is never visible to a third party.

A multi-region trail records every management API call against the account, including every KMS Encrypt, Decrypt, and GenerateDataKey on the CSR-keys, database, and Apple-keys CMKs. We can answer 'who decrypted what, when' for any access, ours or theirs.

CloudTrail logs land in a private S3 bucket with versioning, KMS encryption, log-file integrity validation, a deny-on-insecure-transport policy, and a Glacier-then-expire lifecycle.

Sensitive actions (Apple account connections, CSR generation, certificate revocation, CLI token issuance, role changes) are written to an audit table with org id, user id, action, entity, and a JSON detail payload.

Amazon GuardDuty continuously analyses CloudTrail, VPC Flow Logs, DNS, S3, Lambda network activity, and RDS logins for indicators of compromise: credential exfiltration, anomalous API usage, known-bad IPs.

Every Apple Developer sync records a row with start time, end time, status, item counts, changes detected, and the error message if it failed. Useful for compliance, useful for debugging.

Billing webhooks are verified with HMAC-SHA256 and a five-minute timestamp window using constant-time comparison. We won't act on a forged or replayed event.