> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security controls summary

> A control-by-control summary of the Enfors gateway, and how to get the full review package.

| Control                                     | Implementation                                                                                   |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| TLS encryption in transit                   | HTTPS/TLS 1.3 for all traffic — gateway (`llm.enfors.ai`) and watcher uploads (`data.enfors.ai`) |
| Encryption at rest                          | AES-256 across session database, logs, queues, and backups                                       |
| Data residency                              | AWS us-east-1 — no cross-region replication                                                      |
| Tenant isolation                            | RLS enforced at the database layer — not application-dependent                                   |
| Data retention                              | 14-day retention on session data, logs, and backups; 4-day main queue                            |
| Access to customer data                     | Engineering on-call only — no standing access for other staff                                    |
| No endpoint CA (coding assistants)          | The watcher installs no root certificate and performs no TLS interception                        |
| Watcher auth (Claude Code + Claude Desktop) | Cognito OAuth2 + PKCE id-token, short-lived and auto-refreshed                                   |
| Gateway auth (agent SDKs)                   | per-tenant LiteLLM key, rotatable without machine changes                                        |
| Full session logging                        | Prompt content, response content, and metadata captured per turn                                 |
| Audit trail                                 | All session metadata logged with timestamp, agent, model                                         |
| Revocation                                  | Revoke the user in Cognito → watcher uploads stop; rotate the LiteLLM key for the gateway        |
| Offboarding                                 | `enfors stop` + remove the `ai.enfors.watcher` LaunchAgent and `~/.enfors/hooks`                 |

## Getting the full review package

A complete **IT & CISO Deployment Package** is available under NDA. It includes:

* The watcher internals (what it reads, what it uploads, how it authenticates)
* The gateway capture path for agent SDKs
* The MDM (Jamf/Mosyle) rollout runbook for the watcher
* The full captured-field reference

<Card title="Request the IT & CISO package" icon="envelope" href="mailto:pinhas@enfors.ai">
  Contact your Enfors representative for security questions, DPA requests, or an
  architecture review.
</Card>