> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform security

> AMLOK controls for access, infrastructure, application changes, and monitoring.

## Identity and access

AMLOK uses individual accounts, least-privilege access, and separation of ordinary and privileged operations. Staff and privileged access use multifactor authentication. Access is approved for a defined purpose, reviewed when responsibilities change, and revoked when no longer required.

Production support access is limited to authorized personnel, bounded by purpose and time, and recorded. Emergency access requires a separate review. Service identities and credentials are scoped to their functions, with secrets kept outside application code and customer-facing content.

Customer authentication options, roles, and administrator permissions are confirmed during onboarding for your deployment.

## Encryption and key management

AMLOK encrypts restricted information in transit and at rest, including relevant databases, object stores, and backups. Key administration is separated from ordinary data access. Production and non-production environments use separate credentials and access boundaries.

Your security review can cover the deployment's transport protection, encryption mechanisms, key management, rotation rules, and recovery arrangements. Agree the configuration details and supporting evidence needed during [due diligence](https://docs.amlok.io/security/due-diligence.md).

## Tenant and environment separation

AMLOK checks authorization at tenant boundaries. Isolation testing covers requests, storage, search indexes, queues, caches, exports, logs, and backups. Development and demonstrations use synthetic or appropriately approved masked data.

Infrastructure controls include restricted database access, controlled network paths, protected storage, monitored configuration changes, and outbound-access limits. Configuration reviews address the deployed environment and its dependencies.

## Secure development

The development process includes peer review, automated checks, dependency and secret scanning, controlled releases, and records of material changes. Vulnerabilities are prioritized by severity, exploitability, exposure, and customer impact.

AMLOK's vulnerability-management policy defines remediation targets and exception procedures. Customer-specific service commitments are set out in the agreement. Where independent testing has been performed, review its scope, date, findings, and remediation against the service and version assessed.

## Logging and monitoring

Security records support investigation of authentication, privilege changes, data access, exports, configuration changes, and material workflow actions. Logs are access-controlled and protected from unauthorized alteration, with sensitive payloads minimized.

Operational procedures assign alert ownership, escalation, log retention, and review responsibilities. Investigations distinguish model-generated observations from verified security events and findings.

## People and suppliers

The security program includes confidentiality obligations, security awareness, access lifecycle procedures, and supplier reviews, with designated responsibilities. Incident-response procedures include exercise planning and follow-up on identified improvements.

Use [due diligence](https://docs.amlok.io/security/due-diligence.md) to agree the evidence needed. See [incident response](https://docs.amlok.io/security/incident-response.md) for investigation and recovery procedures.

## Web-application safeguards

The [published application security policy](https://app.amlok.io/security) describes these safeguards for **app.amlok.io**. Review the relevant architecture and configuration separately for an enterprise API or dedicated deployment.

| Area | Published application safeguards |
| - | - |
| Transport and edge | TLS 1.3 at the managed edge, HSTS, web-application firewall, and DDoS protection. |
| Sessions | Signed session cookies with HttpOnly, Secure, and SameSite protections; time-limited, single-use password-reset tokens. |
| Authorization | Server-enforced roles and access grants, with organization-scoped application records. |
| Storage and operations | Encryption at rest in the documented managed storage services, restricted production access, and versioned database migrations. |
| Deployment and monitoring | Immutable deployments traceable to commits, structured error records, and operational monitoring. |
| Identity verification | Hosted identity verification through the applicable provider flow, with limited-duration handoff tokens. |

See [privacy and data handling](https://docs.amlok.io/security/privacy.md) for privacy requests and policies, and [hosting and subprocessors](https://docs.amlok.io/security/hosting-and-subprocessors.md) for the provider register.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.