# What protects your data, and how. — Hanzo AI > Enterprise security architecture: sovereign tenant isolation, edge identity verification, post-quantum cryptography, and immutable audit logs. Security Architecture # What protects your data,and how. Clear security mechanisms: which key encrypts your data, where tenancy boundaries are enforced, and how every request is verified. [Talk to Security Team](https://hanzo.ai/contact)[Security Documentation](https://docs.hanzo.ai/docs/cli/security) Continual internal audits, with the report on request. [The controls, and how to check them](https://hanzo.ai/trust). The controls, named - Encryption at Rest and in Transit01 - Second Factors02 - Keys and Tokens03 - Who May Reach What04 - The Edge Throws Identity Away05 - Where It Sits06 At rest, each organization is its own file on Hanzo Base, and where a master key is configured each file opens under its own key, derived through HKDF-SHA256. In transit the edge speaks TLS 1.3 and offers hybrid ML-KEM-768 key exchange to clients that support it, so their traffic captured today cannot be read by a quantum computer later. An authenticator app, or a code by SMS or email, with recovery codes. Enrolment hands out the material and demands it back before it writes anything, and adding or dropping a factor signs the account out of every other browser — a stolen session that outlives the change is the same as not having the factor. A key is told apart from a token by its prefix, so nothing has to guess what it was handed. Tokens are refused outright if they carry an HMAC signature or no algorithm at all, and a refresh token is single-use — presenting a spent one revokes its whole family rather than the one token. Access is a grant at a place: an organization, a workspace under it, a project under that. A check asks whether some grant the caller holds covers the path and admits the verb. One rule, no special cases, and the decision is a function call rather than a service that can be down. Anything that arrives claiming to be an org, a user or an email is deleted at the gateway before a single handler reads it. Identity is written back only from a verified token. Inside the cluster, services reach each other over a binary protocol rather than the public internet. An organization is a tenancy boundary, and on Hanzo Base it is a physical one — a different organization is a different database file, so no query can reach across two. Dedicated and self-hosted deployments pin that file to a region you choose. Infrastructure ## What runs underneath Workloads sit in hardware-virtualised machines on managed Kubernetes, in data centres with physical access control and redundant power. Secrets never reach a manifest — they are fetched from Hanzo KMS at boot, and outside development a service refuses to start without a verified issuer, audience and key set rather than falling back to running open. Hardware-virtualised machines, one tenant to a boundary Errors, traces and release health watched around the clock Replicated, with failover that does not need a person Every image pinned to a version, every deploy reconciled ### Or none of our infrastructure at all Every piece named on this page is a binary you can run yourself. The strongest answer to a question about our infrastructure is that you do not have to use it. Run it where you like Our cloud, your cluster, your rack Scales to nothing Idle should cost what idle is worth Your region Pin the data and keep it there Enterprise ## If you are the one who has to sign off Bring the control you are required to demonstrate and we will show you the code that implements it, or tell you plainly that it does not exist yet. A control we cannot point at is one you should not put your name to. Where a requirement is not met, the honest options are usually self-hosting, a dedicated deployment, or waiting. Our engineers will say which one applies rather than selling you the gap. ### What comes with Enterprise An engineer who has read your deployment, retention you set rather than inherit, and somebody to answer the questionnaire your procurement team is about to send. Single sign-on through Hanzo IAM Federation to your own OpenID Connect issuer SCIM 2.0 provisioning from your directory A named engineer who knows your deployment Priority incident response Retention set by you, not by us Audit records exported where you want them Security questionnaire support [Contact Sales](https://hanzo.ai/contact-sales) ### Found something Email us rather than opening a public issue, and include a reproduction if you have one. A real report from a stranger is worth more than an internal review, and we answer quickly. [security@hanzo.ai](mailto:security@hanzo.ai) ## Ask us the hard question Bring the requirement you cannot get past, and we will show you the code or tell you it is not built. Both answers are more useful than a brochure. [Try Hanzo](https://hanzo.ai/login)[Schedule Security Review](https://hanzo.ai/contact-sales) [Read the security documentation](https://docs.hanzo.ai/docs/cli/security)