Skip to content
Silux Connect
Trust Center

Built for the regulated.
Open to everyone.

Silux Connect is engineered to clear the bar at hospitals, banks, and ministries — and priced for the technician at the corner workshop. Below is the evidence.

Compliance status

NDA-gated reports are available from the trust portal. Email trust@siluxconnect.com to request access.

SOC 2 Type II

In progress

Observation period in progress. Type I report available under NDA.

Request report (NDA) →

HIPAA BAA

Available

BAA available on request. Self-service flow at /hipaa.

Request report (NDA) →

GDPR / UK GDPR

Available

Full DPA, Standard Contractual Clauses, and EU-region pinning available.

Request report (NDA) →

ISO 27001

Planned

Stage 1 audit scheduled for Q4 2026. ISMS documentation complete.

Request report (NDA) →

FedRAMP Moderate

Mapped

Controls mapped to NIST 800-53 Rev. 5 baseline. Awaiting sponsor.

Request report (NDA) →

PCI DSS v4.0

Mapped

SAQ-D-eligible architecture. Payment data tokenised by Stripe.

Request report (NDA) →

NIST CSF 2.0

Mapped

All six functions mapped. Identify, Protect, Detect, Respond, Recover, Govern.

Request report (NDA) →

Encryption

TLS 1.3 in transit

HSTS preload. AEAD ciphers only. Perfect Forward Secrecy via ECDHE on every handshake.

AES-256-GCM at rest

Envelope encryption. Per-tenant KEK wraps per-resource DEKs. Optional customer-managed KMS.

Per-session keys

Every relayed session derives a fresh session key. The Silux Relay sees ciphertext only.

Customer-managed KMS

Bring your own AWS KMS or HashiCorp Vault. We never touch the master key.

Architecture

End-to-end encrypted. The relay routes ciphertext. Only your operators and your endpoints hold the keys.

OperatorWeb / Desktop / MobileHolds session keyWebAuthn + MFASilux RelayRegion-pinnedSees ciphertextonlyTLS 1.3 + WSSNo keys at restEndpointWin / mac / Linux / MobileHolds session keyOpen-source agentEncrypted streamEncrypted streamECDHE handshake → per-session key. AES-256-GCM payload. Relay never holds the key.

Data residency

Three regions. You choose where your tenant lives.

  • EU (eu-west-1) — GDPR, no data egress without consent.
  • US (us-east-1) — HIPAA-eligible, BAA available.
  • APAC (ap-southeast-1) — Singapore.
See sub-processors →

Audits and testing

Continuous SAST, weekly DAST, annual external pen test.

  • Continuous SAST on every commit (Semgrep + CodeQL).
  • Weekly DAST against staging (OWASP ZAP).
  • Annual third-party black-box pen test.
  • Quarterly red-team-style exercises.
  • Last pen test: pending — coming Month 2 of launch.
Bug-bounty program →

Identity and access

SSO + SCIM

SAML 2.0 and OIDC. Auto-provisioning via SCIM 2.0. SSO Tax: zero.

Phishing-resistant MFA

Two-factor on every account and every sign-in: codes by email, Telegram or authenticator app, plus WebAuthn passkeys. Saved connection passwords are stored encrypted.

Five-role RBAC

Viewer / Technician / Admin / Owner / Super Admin. Tenant boundary enforced server-side.

JIT elevation

Time-bound privilege escalation. Two-person rule for destructive operations.

Trust badges

SOC 2 in progress
HIPAA
GDPR
UK GDPR
PCI DSS mapped
NIST CSF 2.0

Hall of Fame

Researchers who reported valid security findings are recognised here with their consent. Be the first.

No public disclosures yet. Submit yours at /vulnerability-disclosure.

Keep reading