Security

The security model

Mandate Labs sits in the authorization path of financial transactions, so the platform is engineered around three properties that hold even when something goes wrong:

• Fail-closed by default. If the decision engine cannot be consulted, the advisory response for agent-initiated transactions is a decline recommendation. Clients may configure a bounded fail-open policy below an explicit amount threshold, per principal — a deliberate, documented choice, never an accident of an outage.
• A hash-chained audit trail. Every authorization decision is written to an append-only audit log in which each record is cryptographically chained to the previous one. Decision history cannot be silently edited or deleted — by us or by anyone else.
• Signed, verifiable decisions. Decision records, crypto-rail transfer attestations, and Agent Trust Report certificates are signed with Ed25519 keys published at our JWKS endpoint. Any party can verify them offline — integrity does not depend on calling us back.

Encryption & key management

• All data encrypted in transit using TLS 1.2 or higher.
• All sensitive data encrypted at rest using AES-256.
• Field-level encryption on sensitive authorization-log attributes, with managed key rotation (strengthened platform-wide in the v0.6.0 hardening release).
• Signing keys are purpose-separated — decision signing, attestation signing, and OAuth token signing each use dedicated keypairs with independent rotation, published under distinct key IDs.
• No primary account numbers (PANs) are stored — all card data is tokenized.

API & credential security

• API keys are hashed (SHA-256) before storage and never stored or logged in plaintext; the raw key is shown exactly once at issuance.
• Scoped, least-privilege credentials: a key that only authorizes transactions cannot manage agents or read unrelated data. Scopes are enforced on every request.
• IP allowlisting per credential, credential expiry, and rotation with a configurable grace period.
• OAuth2 client credentials for enterprise integrations: 15-minute EdDSA-signed bearer tokens verified against our published JWKS, with pinned algorithms and audience checks. Compromise recovery is bounded by token lifetime.
• Certificate-bound tokens (mTLS) for the issuer-vault tier are on the security roadmap.
• Dashboard access requires MFA (TOTP); back-office actions are governed by server-side, role-based access control — the UI never grants what the server would refuse.

Tenant isolation

• Isolation is enforced in the decision engine and data layer, not just the interface — every query is tenant-scoped, and cross-tenant access is structurally impossible through the API surface.
• Program managers see only their own agents, principals, and decisions; principals control their own keys, rate limits, and thresholds.
• Sensitive rule changes are governed by dual-approval (maker-checker) workflows — no single operator can deploy a risk-rule change alone.

Infrastructure & network

• Infrastructure hosted on SOC 2-compliant cloud providers.
• Edge protection with WAF rules, API schema enforcement, and rate limiting on authentication-sensitive paths — requests that do not match the published API surface are rejected at the edge.
• Network isolation and least-privilege service accounts throughout.
• Production resilience validated under sustained load — 150K+ authorizations per hour with a 0.05% error rate and zero 5xx responses in continuous testing.

Testing & assurance

• Adversarial threat modeling as an engineering practice — including agent-native attack classes such as prompt injection, credential replay, and behavioral-drift attacks, which the platform itself is built to detect.
• Formal security assessment (June 2026) with every finding tracked to closure in a remediation log.
• Periodic third-party penetration testing.
• Regular internal security assessments and audit logging.
• Security-relevant platform changes ship through reviewed, versioned releases — v0.6.0 was a dedicated security and reliability hardening release.

Compliance

• SOC 2 Type II — Mandate Labs' own SOC 2 Type II assessment is in progress.
• OWASP Top 10 — compliant.
• GDPR — Data Processing Addendum available for EU/EEA customers.
• CCPA — compliant.
• PCI posture — no PAN storage; card data handling is tokenized and PCI-DSS-aligned.
• Compliance reporting built into the product: SAR/STR export in FinCEN BSA and Panama UAF Law 23 formats, with the complete decision context attached.

Data handling

• Customer Data remains the property of the customer at all times.
• Authorization logs retained per service tier (details in the SLA).
• Data export available on request and for 60 days post-termination.
• SAR/STR export capability for regulatory compliance.

Incident response

• A structured incident response program aligned to the NIST lifecycle — preparation, detection and analysis, containment, eradication, recovery, and post-incident review — with defined severity tiers and on-call ownership.
• Customer notification runs on contractual clocks: within 48 hours under our Data Processing Addendum, and within 72 hours where GDPR applies.
• Blameless post-mortems on major incidents, with corrective actions tracked to closure.

Responsible disclosure

We welcome reports from security researchers.

• Contact: security@mandatelabs.ai — also published in our security.txt.
• We investigate all valid reports within 72 hours.
• We will not take legal action against researchers who act in good faith.
• Please allow us reasonable time to address issues before public disclosure.

Questions