Security Architecture

Encryption: OAuth tokens (AES-256-GCM), API keys (AES-256-CBC), passwords (bcryptjs), sessions (JWT), backups (AES-256-GCM + PBKDF2), cloud creds (encrypted in DB), SAML certs + LDAP bind passwords (encrypted in DB), chat session files (AES-256-GCM, per-turn IV), request/response body archive (AES-256-GCM, per-file IV — see Section 35.1). Network: HTTPS enforcement, Helmet.js headers, CORS, IP allowlisting (CIDR), mTLS for agents, request size limits (50MB), Redis TLS. HTTP/3 hardening: every response path that proxies upstream traffic strips Alt-Svc and Alternate-Protocol headers so browsers don’t cache a QUIC endpoint and bypass the TCP-only MITM on the next request (see Section 30.3). Private VPC / no direct internet egress: AgentWatch can deploy fully inside a private VPC with no direct internet egress. All outbound LLM calls route through an explicit egress proxy (Zscaler integration, Section 5.3) which can do TLS inspection of the gateway → provider channel. Endpoint: Local CA in OS trust store, CRL Distribution Point endpoint, signed installers (Apple Developer ID + notarization on macOS; Authenticode on Windows). Sensitive log scrubbing: DLP runs on log emission as well as on the request path — user identifiers, API keys, and PII never appear in cleartext in audit ndjson, ClickHouse rows, or Kafka events. Redacted summaries replace raw prompts in error log streams by default. Secret storage: API keys, OAuth tokens, SAML certificates, LDAP bind passwords, cloud creds — all encrypted at rest in the primary DB with envelope encryption keyed by CREDENTIAL_ENCRYPTION_KEY. External vault managers (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk) are not natively integrated as of v2.0.105 — see Section 43.1.

---