Aeion Auth Security Architecture
What's encrypted, where keys live, what RFCs are honored, and what each audit-log row contains. The security model that makes Aeion Auth a defensible foundation for SOC 2, ISO 27001, HIPAA, and GDPR posture.
Standards Compliance Inventory
TOTP
RFC 4226 (HOTP) + RFC 6238 (TOTP) — ±1 time-step window for clock drift
PKCE
RFC 7636 (S256 challenge method) on all OAuth flows
OAuth 2.0
RFC 6749 + RFC 6750 (Bearer Token usage)
OIDC
OpenID Connect Core 1.0
WebAuthn
W3C WebAuthn Level 2 + FIDO2 CTAP2
JWT
RFC 7519 + RFC 7515 (JWS) — RS256 + ES256 signing
Password hashing
Argon2id (memory cost 64MB, time cost 2 — Bun runtime defaults)
Encryption at rest
AES-256-GCM, with an independent, context-scoped key per data class
TLS
TLS 1.2 minimum; TLS 1.3 preferred; mTLS supported
Encryption Model — What's Encrypted, How
Every credential, token, and secret in Aeion Auth is encrypted before it touches the database. Each data class gets its own derived encryption key — a compromise of one credential store (say, OAuth tokens) doesn't help decrypt another (say, MFA secrets).
Login History — The Immutable Audit Trail
Every authentication event lands in an append-only audit log — enforced at the application layer, and backed by continuous, tamper-resistant storage-layer archiving for defense in depth.
Session Management
Hybrid session model — short-lived JWT access tokens + opaque Redis refresh tokens. Best-of-both: stateless edge verification on the hot path, server-side revocation on the slow path.
Compliance Mapping
What this architecture proves to which auditor.
What this page is NOT.
This is the architecture. It's not a SOC 2 audit report — software itself doesn't get SOC 2 / ISO 27001 / HIPAA certified, a specific deployment does. The compliance mapping above shows which controls the architecture supports; your auditor still needs evidence that YOUR specific deployment is running it correctly. The Aegis compliance reports are the bridge — they prove the architecture is being honored in production.
Identity hardened at every layer.
Real RFC standards, real encryption, real audit log. The foundation for whatever compliance posture you're driving toward.