Security controls summary

Control	Implementation
TLS encryption in transit	HTTPS/TLS 1.3 for all traffic — gateway (`llm.enfors.ai`) and watcher uploads (`data.enfors.ai`)
Encryption at rest	AES-256 across session database, logs, queues, and backups
Data residency	AWS us-east-1 — no cross-region replication
Tenant isolation	RLS enforced at the database layer — not application-dependent
Data retention	14-day retention on session data, logs, and backups; 4-day main queue
Access to customer data	Engineering on-call only — no standing access for other staff
No endpoint CA (coding assistants)	The watcher installs no root certificate and performs no TLS interception
Watcher auth (Claude Code + Claude Desktop)	Cognito OAuth2 + PKCE id-token, short-lived and auto-refreshed
Gateway auth (agent SDKs)	per-tenant LiteLLM key, rotatable without machine changes
Full session logging	Prompt content, response content, and metadata captured per turn
Audit trail	All session metadata logged with timestamp, agent, model
Revocation	Revoke the user in Cognito → watcher uploads stop; rotate the LiteLLM key for the gateway
Offboarding	`enfors stop` + remove the `ai.enfors.watcher` LaunchAgent and `~/.enfors/hooks`

Getting the full review package

A complete IT & CISO Deployment Package is available under NDA. It includes:

Contact your Enfors representative for security questions, DPA requests, or an architecture review.