Platform Security

1. B2B Authentication & SSO

Scryme enforces strict identity separation at the tenant level. All authentication is managed via Zitadel SSO OIDC redirects or secure local session tokens processed directly into our isolated PostgreSQL database. Standard organizational scopes (like org_info and membership) safeguard all API actions.

2. Data Encryption

Our B2B platform incorporates military-grade encryption practices across all layers of operations:

• Data in Transit: All web, desktop, and API communication is strictly forced over TLS 1.3 protocol.
• Data at Rest: Database rows containing sensitive tokens, passwords, or transaction records are encrypted using AES-256 keys.
• Tauri-based POS local storage: Offline-first databases operating locally are encrypted and locked using host credentials.

3. Secure Webhook Delivery

When Scryme triggers notifications, approvals, or channel events to Slack or third-party webhooks, payload schemas are cryptographically signed using shared secrets. This prevents webhook spoofing and replay attacks.

4. Reporting Vulnerabilities

If your security researchers identify any platform vulnerabilities, please submit detailed reproduction reports directly to our response desk at security@scryme.tech.