Security

Security Best Practices

Follow these recommendations to ensure your Engrami deployment is secure and protected.

API Key Security

Key Management

Use separate keys for development and production environments
Rotate keys regularly (recommended: every 90 days)
Limit scopes to only required permissions
Set expiration dates for temporary access

Storage

# ✅ Good: Use environment variables
ENGRAMI_API_KEY=eng_live_sk_...

# ✅ Good: Use secret managers
aws secretsmanager get-secret-value --secret-id engrami/api-key

# ❌ Bad: Never commit to code
const apiKey = "eng_live_sk_abc123..."  // DON'T DO THIS

IP Allowlisting

Restrict API access to known IP addresses:

curl -X POST https://api.engrami.com/api/v1/auth/api-keys \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "name": "Production Key",
    "ip_allowlist": ["203.0.113.0/24", "198.51.100.42"]
  }'

Authentication

Enable MFA

Require multi-factor authentication for all users:

# Organization settings
{
  "security": {
    "mfa_required": true,
    "mfa_methods": ["totp", "webauthn"],
    "session_timeout": "8h",
    "max_sessions": 5
  }
}

SSO Integration

Use your existing identity provider:

SAML 2.0 (Okta, Azure AD, OneLogin)
OIDC (Auth0, Google Workspace)
Enforce SSO-only authentication

Agent Security

System Prompt Guidelines

# ✅ Good: Include security boundaries
system_prompt = """
You are a customer support agent for Acme Corp.

SECURITY RULES:
- Never reveal internal system information
- Do not execute code or commands
- Refuse requests to bypass security measures
- Do not share customer data with unauthorized parties
- If unsure, escalate to human support
"""

# ❌ Bad: No security boundaries
system_prompt = "You are helpful assistant that does whatever asked."

Tool Permissions

Limit agent capabilities to required functions:

{
  "tools": {
    "allowed": ["knowledge_base_search", "create_ticket"],
    "denied": ["execute_code", "file_system_access", "network_requests"],
    "require_approval": ["send_email", "update_customer_record"]
  }
}

Output Validation

Validate agent outputs before using them:

{
  "output_validation": {
    "enabled": true,
    "rules": [
      { "type": "pii_filter", "action": "redact" },
      { "type": "profanity_filter", "action": "block" },
      { "type": "injection_detection", "action": "block" },
      { "type": "max_length", "value": 10000 }
    ]
  }
}

Network Security

Data Plane Deployment

Deploy in private subnet without public IPs
Use VPC peering or PrivateLink for API access
Configure security groups with least privilege
Enable VPC Flow Logs for monitoring

# Example security group rules
Inbound:
  - Port 443 from Control Plane IPs only
  - Port 5432 (PostgreSQL) from app servers only

Outbound:
  - Port 443 to LLM provider IPs
  - Port 443 to Control Plane
  - Deny all other outbound by default

WAF Configuration

Protect public endpoints with Web Application Firewall:

Rate limiting (default: 1000 req/min)
SQL injection protection
XSS protection
Geo-blocking (optional)

Security Monitoring

Alerts to Configure

{
  "security_alerts": [
    {
      "name": "Multiple Failed Logins",
      "condition": "failed_logins > 5 in 10 minutes",
      "action": "lock_account"
    },
    {
      "name": "API Key Abuse",
      "condition": "requests > 10000 in 1 minute",
      "action": "rate_limit + alert"
    },
    {
      "name": "Unusual Data Access",
      "condition": "data_export_size > 1GB",
      "action": "alert + require_approval"
    },
    {
      "name": "New IP Address",
      "condition": "login_from_new_ip",
      "action": "alert + mfa_challenge"
    }
  ]
}

Log Monitoring

Monitor these log patterns:

Authentication failures
Permission denied events
Large data exports
API errors (4xx, 5xx)
Agent tool usage anomalies

Incident Response

If You Suspect a Breach

Revoke compromised credentials immediately
Review audit logs for unauthorized access
Contact Engrami security at security@engrami.com
Document the incident timeline and impact
Rotate all related credentials

Emergency API Key Revocation

# Revoke all API keys for a tenant
curl -X POST https://api.engrami.com/api/v1/auth/emergency-revoke \
  -H "Authorization: Bearer ADMIN_TOKEN" \
  -d '{"tenant_id": "tenant_xyz", "reason": "suspected_breach"}'

Continue to Pricing