Security & governance

Your data.
Isolated.

Financial data deserves a security posture that isn't a compliance checklist. Airtight sealed the architecture first and hung the certifications off the side. Here's what's actually in the box.

Sealed tight by design. Certifications in progress.

Encryption

Four layers. Keys per organisation. No shared secrets.

Every organisation gets its own key hierarchy. Sensitive fields are sealed with keys no other tenant can access.

Layer 1 · CMK
Customer Master Key

AWS KMS. Never leaves the HSM.

Layer 2 · KEK
Key Encryption Key

Per-tenant. Wraps the DEK. Generated on tenant creation, never logged.

Layer 3 · DEK
Data Encryption Key

Per-tenant-per-environment. Encrypts sensitive data at rest.

Layer 4 · FLD
Field sealing

Employee tax file numbers and bank details, and payment-gateway credentials, are sealed before they are stored.

What is sealed today. Employee tax file numbers and bank details, and payment-gateway credentials, use this hierarchy. Other data is protected by row-level security and encryption at rest.

Architecture

Six pillars, all load-bearing.

Triple-entry cryptographic receipts

Every journal entry posted to the ledger gets an Ed25519-signed receipt, linked to the previous receipt by SHA-256. A later change to a receipt breaks the chain and is caught when you verify it. It is a linear hash chain, not a Merkle tree, and you verify it inside Airtight.

Ed25519 · SHA-256 hash chain

Per-tenant envelope encryption

A four-layer key hierarchy protects employee tax file numbers, bank details and payment-gateway credentials. Your organisation's keys are not shared with any other tenant.

CMK → KEK → DEK → field

Row-level security, everywhere

PostgreSQL RLS on every tenant table. Cross-tenant queries are refused by the database, not left to a code-path convention. A CI gate checks for reads that bypass it.

FORCE RLS · tenant tables

Passkeys, not passwords

WebAuthn passkeys first. TOTP fallback for the passkey-averse. No SMS — SMS is not security. Session tokens rotate on use; reuse revokes the user's sessions.

WebAuthn · TOTP · no-SMS

Append-only audit log

Posting, voiding, reversing, un-posting, deleting, period locks, account changes and security events are recorded in an append-only log. Not every module records every action yet.

Append-only · ledger + security events

Scoped API keys

Scope a key to specific permissions. Rotate without downtime. Revoke any key at any time — the rest keep working.

Scoped · rotatable · revocable
Standards & certifications

The paperwork. Current state.

Target
SOC 2 Type II

In progress · target report Q4 2026.

Target
ISO 27001

In progress · target Q1 2027.

Active
Australian Privacy Act

Airtight hosts your data in AWS Sydney, Australia. See the privacy policy for processors and cross-border disclosure.

Engineering practice

Security is a line in every file, not a phase.

What we enforce on every pull request, before merge.

Rust dependency advisory scan (cargo-audit) on every PR · a known advisory fails the merge gate
Row-level-security bypass check on every PR
Rate limiting on API requests · keyed by client address
CORS locked to known origins · no wildcards
Money is stored as integer minor units · never floating point
Every route that changes data needs an explicit permission · unmapped routes are refused

Want to interrogate the architecture?

Our security team will walk a CISO through key hierarchy, receipt verification, RLS proofs, and incident playbooks. Signed NDAs on request.

Book a security walk-through See features →