secure by design. every session, every credential, every byte.

Zero-trust access, TLS 1.3 for user-facing sessions, AES-256-GCM envelope encryption for recordings and full audit trails were non-negotiable requirements — not afterthoughts.

Start free trial → View compliance map

01 Security principles

Seven principles that govern every decision.

Zero-trust access

Every session is authenticated and authorized per-request. No implicit trust from network location, role, or prior session.

Encrypted in transit and at rest

User-facing sessions are encrypted in transit with TLS 1.3. Recordings are encrypted at rest with AES-256-GCM envelope encryption.

Least-privilege by default

Minimum access required, enforced at runtime: time-limited sessions, just-in-time credential injection, automatic expiry.

Recording integrity & access audit

Recording content is protected by a SHA-256 hash chain with durable integrity manifests and an offline verifier. Every access to recordings — successful or denied — is recorded in the audit log.

EU data residency

All data, recordings and vaults reside in GCP europe-central2 (Warsaw). No transfer outside the EU.

No credential exposure

Credentials are injected at the protocol level and never exposed to the connecting user. Passwords stay inside the proxy.

Continuous compliance posture

NIS2, GDPR, SOC 2 and ISO 27001 controls mapped to features. Reports generated on demand, not assembled by hand.

02 Authentication & authorization

MFA, SSO and role-based access — without the configuration tax.

Capability	Mechanism	Standard
Multi-factor authentication	TOTP, FIDO2/WebAuthn, SMS OTP	RFC 6238 / FIDO2
Single sign-on	SAML 2.0, OIDC / OAuth 2.0	SAML 2.0 / OIDC
Role-based access control	Tenant roles, session policies, target ACLs	NIST RBAC
Just-in-time credentials	Time-limited vault checkout, auto-rotation	NIS2 Art. 21
Session timeout	Configurable per-role idle + max duration	SOC 2 CC6.1

03 Data protection

Encryption and storage your legal team can sign off.

Fig. 02 Credentials are retrieved from the encrypted vault and injected at the protocol level — the connecting user never sees the password.

3.1

Credential vault

Encrypted at rest with AES-256-GCM. Vault keys stored separately and rotated automatically. Keys are never logged.

3.2

In-transit encryption

User-facing sessions and the browser access path are encrypted with TLS 1.3. Internal service calls carrying recording metadata and evidence are mutually authenticated (mTLS).

3.3

Session recordings

Stored in GCS (europe-central2), object-level encryption. Audit access controlled separately from replay.

3.4

EU data residency

All data, backups and logs reside in GCP europe-central2 (Warsaw). No cross-region replication outside the EU.

3.5

Retention controls

Recordings follow configurable retention (30–365 days) with legal-hold safeguards. Deletions are audited.

3.6

Backup & recovery

Daily automated backups, point-in-time recovery. Encrypted at rest and tested quarterly.

04 Threat model

STRIDE — verified against every release.

Threat	Control	Status
Spoofing	MFA + session token binding	MITIGATED
Recording-content tampering	SHA-256 recording hash chain + durable integrity manifests + offline verifier	MITIGATED
Audit-event tampering	Access-controlled and audited	ACCESS-CONTROLLED & AUDITED
Repudiation	Every recording access — successful or denied — is recorded in the audit log	MITIGATED
Information disclosure	AES-256-GCM at rest; user-facing sessions and the browser access path are encrypted with TLS 1.3; internal service calls carrying recording metadata and evidence are mutually authenticated (mTLS); no credential exposure	MITIGATED
Denial of service	Rate limiting, connection caps, WAF (ModSecurity)	MITIGATED
Elevation of privilege	RBAC, least-privilege JIT credentials, tenant isolation	MITIGATED

05 EU residency

Your data stays in the EU. Always.

Fig. 03 All data, recordings and credentials terminate in GCP europe-central2 (Warsaw). Cross-border transfer is architecturally blocked — not a setting.

VaultPAM runs exclusively on GCP europe-central2 (Warsaw). No data is transferred or replicated outside the EU — a hard architectural constraint, not a setting.

Start free trial → Compliance map

✓GCP europe-central2 (Warsaw) — primary and only region
✓No cross-region replication outside EU
✓GDPR/RODO Article 44 — no third-country transfers
✓NIS2 Article 21 residency controls satisfied
✓SOC 2 Type II audit in progress; report pending 2026