Home/Security
ATTESTATION // ZERO_TRUST_STD

Security Standards.

AES-GCM-256 Encryption · SOC2 Type 2 Standards · Zero-Trust Principles

// 01. Cryptographic Enclaves

All production systems architected by Codedway default to strict envelope encryption using AES-GCM-256 at rest and TLS 1.3 in transit. Client data keys are managed through dedicated hardware security modules (AWS KMS, GCP Cloud KMS, or HashiCorp Vault) with automated cryptographic key rotation.

// 02. Continuous Vulnerability Scanning

Every commit, pull request, and container image undergoes automated static application security testing (SAST), software composition analysis (SCA), and container vulnerability scans before deployment. We maintain a zero-critical-CVE policy across all production releases.

// 03. Responsible Disclosure

We maintain an active security bug bounty program and welcome reports from independent researchers. If you discover a potential vulnerability in our infrastructure or open-source tooling, please report it directly to security@codedway.com.