Security Architecture & Trust Whitepaper

LAST UPDATED: AUGUST 15, 2026 · SPECIFICATION 1.0

PromptMatrix is engineered from the ground up for high-security enterprise AI engineering teams. This document outlines our multi-layered cryptographic controls, multi-tenant isolation, and vulnerability disclosure protocols.

AES-256-GCM Encryption

All sensitive customer secrets and Bring-Your-Own-Key (BYOK) evaluation credentials are encrypted at rest with authenticated 256-bit Galois/Counter Mode.

SHA-256 Key Hashing

Runtime API keys are never stored in plaintext. Keys are hashed with SHA-256 upon creation and verified with timing-safe comparisons.

Row-Level Tenant Isolation

All workspace queries are strictly scoped by organisation ID at the database layer. Cross-tenant access is structurally impossible.

Zero Model Training

Your prompt templates, test sets, and variable parameters are strictly isolated and never fed into public or private model training pipelines.

1. Data Encryption & Key Management

In Transit: TLS 1.3 enforced across all API endpoints and web consoles. Plain HTTP requests are automatically rejected.
At Rest: PostgreSQL database disks are encrypted using AES-256. Individual sensitive fields (e.g. LLM judge keys) undergo application-layer encryption via separate encryption keys.
Zero Raw Key Storage: When generating a prompt serving key (e.g. pm_live_...), the plaintext key is displayed once. The database retains only its SHA-256 hash digest.

2. Authentication & Authorization

Role-Based Access Control (RBAC): Granular workspace roles (Admin, Member, Viewer) govern prompt drafting, review gating, API key rotation, and billing actions.
Session Tokens: Short-lived JWTs signed with HMAC-SHA256 and separate refresh token rotation.
Webhook Verification: Inbound payment events from Razorpay are verified using cryptographic HMAC-SHA256 signatures before processing.

3. High-Throughput Edge Caching & Isolation

PromptMatrix serves approved prompts with sub-10ms latency. The serving cache stores only approved prompt versions with strict cache invalidation hooks triggered on rollback or new approval events.

4. Vulnerability Disclosure & Bug Reporting

We welcome security reports from researchers and our developer community. If you discover a potential vulnerability:

Email our security team directly at jachinchsaikiasonowal@gmail.com with steps to reproduce.
We commit to acknowledging reports within 24 hours and providing regular remediation status updates.
We request that you adhere to coordinated vulnerability disclosure and refrain from public disclosure until patches are deployed.