KEYXE Security
Security, Permissions, and Accountability.
Review the safeguards implemented on this public website and the access requirements for Amazon account workflows. Production application security and connector operations are maintained separately from this website project.
Website safeguards and application requirements
Implemented
Current Website Safeguards
Built and covered by automated tests in the KEYXE codebase. Items that depend on production configuration say so.
- HTTPS everywhere. The site and API are designed to be served only over HTTPS on Cloudflare. Applies once deployed.
- Security headers. Content Security Policy with hashed scripts, frame-ancestors none, X-Content-Type-Options nosniff, a strict Referrer-Policy and a restrictive Permissions-Policy.
- Bot protection, verified server-side. Every form submission is checked with Cloudflare Turnstile on the server, including hostname and action. Invalid, expired or reused tokens are rejected.
- Input validation and limits. Strict schemas on client and server, 32 KiB body limit, parameterized database queries, and safe error messages without stack traces.
- Rate limiting and idempotency. Repeated submissions are limited per connection, and retries cannot create duplicate cases.
- Privacy-minded logging. Structured logs record outcomes, not content: email addresses are masked, and message bodies, tokens and IP addresses are not logged. IP addresses used for rate limiting are stored only as salted hashes and deleted daily.
- No third-party trackers. No advertising pixels or analytics scripts. Cloudflare Turnstile, on pages with forms, is the single third-party script.
- Dependency hygiene. Exact, reviewed dependency versions with a lockfile. A secret scan and a dependency vulnerability audit are part of the project’s automated checks.
- Controlled open-source export. Any future open-source release is produced by a curated export of allow-listed files into a clean folder, scanned for secrets, personal data and Amazon identifiers, and published only after a recorded human security and license review. Nothing has been published yet.
Application security requirements
Production Application Requirements
The requirements below describe controls relevant to production account workflows. This website repository does not establish the implementation or deployment status of the separate application. Contact KEYXE for an application-specific security review.
- Multi-tenant isolation. Every record and request scoped to one organization, enforced in the data layer.
- Encrypted Amazon token vault. Refresh tokens encrypted at rest with managed keys, never exposed to browsers, vendors or AI clients.
- Audit trail. Who connected, exported, approved or changed what — and when.
- Key rotation. Scheduled rotation of application secrets and encryption keys with documented procedures.
- Data lifecycle. Deletion on disconnection or revocation within the period Amazon’s policies require, plus retention limits for everything else.
- Incident response. Documented triage, containment, notification and review steps, exercised before live data is handled.
Plain statements
What we do not claim
- This page makes no SOC 2, ISO 27001 or other certification claim.
- No independent penetration test result is claimed by this website.
- No HIPAA or industry-specific compliance claims.
- No Amazon certification, partnership or endorsement.
- No uptime guarantee is offered by this public website. Application service terms are agreed separately.
Amazon’s security requirements for applications that handle Amazon data go beyond a secure website. Controls for the separate KEYXE application must be assessed in that deployment; the safeguards documented here describe this public website and its forms.