Aeion Auth Security Architecture
What's encrypted, where keys live, what RFCs are honored, and what each audit-log row contains. The security model that makes Aeion Auth a defensible foundation for SOC 2, ISO 27001, HIPAA, and GDPR posture.
Standards Compliance Inventory
TOTP
RFC 4226 (HOTP) + RFC 6238 (TOTP) — ±1 time-step window for clock drift
PKCE
RFC 7636 (S256 challenge method) on all OAuth flows
OAuth 2.0
RFC 6749 + RFC 6750 (Bearer Token usage)
OIDC
OpenID Connect Core 1.0
WebAuthn
W3C WebAuthn Level 2 + FIDO2 CTAP2
JWT
RFC 7519 + RFC 7515 (JWS) — RS256 + ES256 signing
Password hashing
Argon2id (memory cost 64MB, time cost 2 — Bun runtime defaults)
Encryption at rest
AES-256-GCM, with an independent, context-scoped key per data class
TLS
TLS 1.2 minimum; TLS 1.3 preferred; mTLS supported
Encryption Model — What's Encrypted, How
Every credential, token, and secret in Aeion Auth is encrypted before it touches the database. Each data class gets its own derived encryption key — a compromise of one credential store (say, OAuth tokens) doesn't help decrypt another (say, MFA secrets).
Login History — The Immutable Audit Trail
Every authentication event lands in an append-only audit log — enforced at the application layer, and backed by continuous, tamper-resistant storage-layer archiving for defense in depth.
Session Management
Hybrid session model — short-lived JWT access tokens + opaque Redis refresh tokens. Best-of-both: stateless edge verification on the hot path, server-side revocation on the slow path.
Compliance Mapping
What this architecture proves to which auditor.