Security
The security review, answered up front
The questions a reviewer asks first—what listens on the network, what happens to secrets, what gets judged and what gets recorded—each has a short answer here, with the live status one click away.
Architecture
Small answers to the big questions
What listens on your network?
Nothing. Servers dial out to Alpacon over encrypted tunnels—no inbound ports, no bastion, no change to your network edge.
What happens to secrets in sessions?
Recognized credential formats are masked as the record is written—not cleaned up afterwards. Every read path serves the masked text.
What can a credential do?
Deny by default. A token's command, server and file allowlists start empty; a command not on the list does not run.
What is on the record?
Every command, file transfer and sudo grant lands on one filterable timeline per session, and terminal sessions replay.
How is data encrypted?
TLS 1.3 preferred and 1.2 minimum in transit—AES-256-GCM and ChaCha20-Poly1305 only, with perfect forward secrecy—and AES-256 at rest under AWS KMS.
What can AlpacaX itself see?
Judged commands and session records, masked as written. Our team can't reach into your servers or run anything on them—and your data is never used to train general-purpose AI models, only to run and improve Alpacon's own judgment.
Judgment
Checked before it runs, and checked again after
Commands are judged against the session's declared intent before they reach the host, not flagged after. Session analysis then maps what happened to MITRE ATT&CK—and the technique ids it names are checked back against the catalogue and dropped if they do not resolve. Even the emergency break-glass path lifts only IP and time bounds; the allowlists stay.
Status
Where the paperwork stands
- SOC 2 Type 2 in progress
- Independently penetration tested. Reports are available under NDA through the trust center.
Disclosure
Found something? Tell us.
security@alpacax.com reaches the team directly—first response within 48 hours, safe harbor for good-faith research, and credit when we ship the fix. The full policy, scope and timelines are public.
Read the disclosure policyAvailability
Is it up? See for yourself.
status.alpacax.com is publicly monitored, endpoint by endpoint, with history. And what happens to access if Alpacon goes down is answered in the docs, not left to the imagination.
FAQ
Common questions
Where is my data stored?
Are you SOC 2 / GDPR / HIPAA compliant?
What happens when someone leaves the team?
How is this different from SSH keys and a bastion?
Can I get your security documentation?
Security
Bring your hardest reviewer
A 30-minute demo with the team. We'll walk through a session on your infrastructure and answer anything technical.