01
Encryption-at-rest for TOTP secrets
TOTP secrets encrypted with AES-256-GCM, HKDF-SHA256 key derivation from SESSION_SECRET, versioned envelope (enc:v1). Remaining stored secrets move under the same envelope Q3 2026.
Security & Compliance
Defense-in-depth, by default.
AES-256-GCM encryption at rest for TOTP secrets today, with HKDF key derivation — remaining secrets move under the same envelope Q3 2026. TOTP 2FA. JWT revocation watermark. Per-tenant audit log. ISO 13485 + 21 CFR Part 11 audit support. Built for the security questionnaire, not retrofitted.
Read-only demo · no signup · realistic seeded records
What's hardened
Eleven findings, eleven fixes — every one published.
May 2026 audit closed 11 findings (2 critical, 5 high, 3 medium, 1 low) plus added TOTP encryption-at-rest. Every finding is documented in the BUG_TRACKER. Every fix has tests. The full security posture is published, not hidden behind an NDA.
02
JWT revocation watermark
Per-user jwt_issued_at column. Logout, suspension, or password change bumps it; all live tokens for that user invalidate instantly.
03
TOTP 2FA + backup codes
Per-user TOTP with bcrypt-hashed backup codes. Pending vs active secret separation prevents TOCTOU.
04
Per-tenant audit log
Every CRUD operation logged with actor, tenant, before/after diff. Sensitive entities (passwords, secrets) auto-redacted.
05
E-signatures designed for Part 11 support
Electronic signatures with intent attestation, timestamp, IP, and an append-oriented record. Designed to support FDA-regulated change control.
06
Defense in depth
Username enumeration response normalization. Rate limiting via X-Forwarded-For with TRUSTED_PROXY_DEPTH. Read-audit logging on tenant-scoped reads.
Connected workflow
Security & Compliance works better when the context travels with it.
Azora keeps project work, quality evidence, people, suppliers, units, documents, and customer context on one shared operating core—without a sync job between every team.
- 01Encryption-at-rest for TOTP secrets
TOTP secrets encrypted with AES-256-GCM, HKDF-SHA256 key derivation from SESSION_SECRET, versioned envelope (enc:v1). Remaining stored secrets move under the same envelope Q3 2026.
- 02JWT revocation watermark
Per-user jwt_issued_at column. Logout, suspension, or password change bumps it; all live tokens for that user invalidate instantly.
- 03TOTP 2FA + backup codes
Per-user TOTP with bcrypt-hashed backup codes. Pending vs active secret separation prevents TOCTOU.
- 04Per-tenant audit log
Every CRUD operation logged with actor, tenant, before/after diff. Sensitive entities (passwords, secrets) auto-redacted.
“Most SaaS vendors answer security questionnaires by attaching a SOC2 PDF. Azora answers by linking to the commits. Every fix in the May 2026 third-party audit has a diff, a test, and a ticket. The full posture is published, not under NDA.”
11Audit findings closed (May 2026)
AES-256GCM for TOTP secrets at rest, with HKDF derivation
0Plaintext TOTP secrets in any column
Open beta nowFree, demo-first, and sales-provisioned within 24 hours.
At GA: one plan, every module — value-based pricing sized to your team, with a 30-day full-feature trial and unlimited free read-only viewers. Open-beta design partners lock preferential founding terms for 24 months from GA. Talk to us about pricing.
See it before you talk to sales
The technical brief, then the questionnaire.
Read the architecture brief for the schema, encryption, audit-log structure, and the full May 2026 third-party audit findings. Then send us your questionnaire — we'll return it with diff links.