Security & trust
Sovereignty is a security property.
The safest data is the data that never leaves your boundary. Every Alayra product is designed so you decide what travels, who can act, and what gets recorded.
Your keys stay yours
Provider keys are encrypted at rest — AES-256-GCM in Nexus, the OS keychain in Kinetic. Access keys are stored as hashes and shown once.
No silent data flows
A self-hosted Nexus makes zero outbound calls to Alayra or any third party beyond the providers you configure. Kinetic indexes your code on your machine.
Humans approve
Kinetic agents show a Blueprint before multi-file changes and stop at the Sentry gate before running commands outside the plan.
Everything is auditable
Nexus keeps an append-only trail of every state-changing action. Kinetic records each agent turn as Blueprint, Mission and Trace files.
Least privilege
Owner, admin and viewer roles; team-scoped keys with their own limits; hard isolation for teams that bring their own credentials.
Your boundary, your call
Self-host Nexus inside your own network and compliance perimeter, or use Nexus Cloud and let us operate it. Your keys either way.
Controls by product
What is built in, specifically.
No vague assurances. These are the controls in the code today.
Alayra Nexus
- AES-256-GCM encryption for provider keys, per-deployment master key
- Team and API keys stored as SHA-256 hashes; admin passwords with scrypt
- TOTP two-factor with recovery codes, SSO (OIDC), login lockout
- SSRF protection on by default; constant-time secret comparison
- Helmet security headers and a CORS allowlist
- Optional guardrails: PII redaction and injection blocking
- Fail-closed admission when Redis is unreachable
Nexus Cloud
- Authenticator-based two-factor and one-time recovery codes
- Session tokens in HttpOnly cookies — never in browser storage
- Workspace-scoped access
- Requests sent on your own provider keys
Kinetic IDE & AIDE
- Local indexing: embeddings and vectors stay on your machine
- Keys in OS-backed secure storage (DPAPI, Keychain, libsecret)
- Blueprint plan consent and risk-scored Sentry command gate
- Per-session audit logs of every approval and rejection
- SSRF defence on custom model endpoints
- Fully local models supported — nothing leaves the machine
- Prompts and code go to the provider you choose; Alayra does not see or store them
- Alayra keeps only account details, token and usage counts, and billing records
Compliance
Straight answers.
Our products are in development, and we have not yet completed third-party audits such as SOC 2 or ISO 27001. We will publish attestations here when they exist — not before.
Until then, self-hosting Alayra Nexus keeps every key, prompt and log inside your own compliance perimeter, under controls you already audit.
Responsible disclosure
Found something? Tell us first.
Please don’t report vulnerabilities in public issues or pull requests — a public fix is a public disclosure. Email us with a description, its impact and steps to reproduce. We’ll acknowledge your report, keep you updated, and credit you when the fix ships if you’d like.
- Alayra Nexus
- report-nexus@alayrasystems.com
- Everything else
- hello@alayrasystems.com