Whole-tree kill
Revoke one certificate and everything delegated beneath it is revoked with it — a compromised agent can't keep operating on borrowed authority.
Security
What we actually built — and what we didn't.
This page describes the real architecture, including its honest limits. We're a young company and don't hold third-party compliance certifications yet — we'd rather say that plainly than put a badge on this page we can't stand behind.
Key custody
We never hold, derive, or read your keys.
This is an architectural property, not a policy promise. The relay routes signed certificates and opaque, encrypted material — it has no code path that reads a private key, and that boundary is enforced by our own test suite, not left to discipline.
- Device keys are P-256, generated and held in software on the caller's own device. We're precise about that word "software": we don't claim hardware-backed storage (a TPM or Secure Enclave) unless the underlying platform actually provides it, and we won't say a key is hardware-bound when it isn't.
- The relay never sees a private key, in transit or at rest — only the public key a certificate is bound to.
- Compromising Richdale's infrastructure does not hand an attacker your keys, because we were never holding them.
private device key never transmitted
public device key visible (in every cert)
certificate scope visible (by design)
certificate signature verified, not held
tenant signing key non-exportable KMS
Revocation
Killing authority doesn't wait for a token to expire.
A traditional session token is valid until it expires, full stop — revocation is a request that the client honor a logout, which a compromised or malicious client can simply ignore. Sigilex enforces at the gateway, on every call, so the decision isn't the client's to make.
Freshness lease
Enforcement gateways are required to hold a fresh view of revocation state — one that expires on its own — so a partitioned or stale gateway can't keep honoring dead certificates indefinitely.
Fail closed
If a gateway can't confirm a certificate is both valid and unrevoked, the request is denied. Ambiguity resolves to "no," never to "allow and hope."
Audit
Verify our audit log without trusting us.
Every issuance, delegation, and revocation decision is appended to a Merkle-structured log with a periodically signed root. We ship the verifier to your browser as WebAssembly, so checking a proof happens on your machine, against the public root — not against a claim we're making about our own database.
- Per-entry inclusion proofs, verified client-side.
- Tamper-evident by construction — altering a past entry breaks the chain above it, visibly.
- Exportable as evidence, for your own auditors or an incident review.
chain integrity intact
entries 4,182
signed root 9f2c…a71d
leaf 4182 VERIFIED ✓ client-side
method in-browser (WASM)
trusted party none required
What we don't claim
Said plainly, not buried in a footnote.
- No compliance certifications yet. We don't hold SOC 2, ISO 27001, or similar third-party attestations today. If that's a requirement for your organization, tell us — we'd rather know it's blocking you than have you assume a badge that isn't there.
- Device keys are software-held, not hardware-backed, unless the underlying platform genuinely provides that (and we'll say so specifically when it does) — we don't imply TPM or Secure Enclave binding by default.
- Revocation propagation has a bound, not an instant guarantee. A gateway's freshness lease means "stale state expires on a known interval," not "zero latency." We publish the real number for your deployment rather than round it down.
Found something?
Responsible disclosure
If you've found a security issue in Sigilex, tell us directly before anywhere else. We respond to every report.