Security

Certificates, signatures, and keys you hold.

Per-device mTLS 1.3, ECDSA command signing, TPM-backed identity, and BitLocker/FileVault escrow. Unverified payloads never reach the executor.

Verification pipeline

Charcoal line sketch of a laptop protected by a shield, with a lock and key.

Cryptographic Pipeline

Multi-Layered Sovereign Protection

NeoUEM decouples management trust from public cloud certificate authorities. Internal X.509 PKI ensures you hold the root keys.

Internal X.509 CA & Per-Device mTLS 1.3

During enrollment, the agent generates an ECDSA keypair locally and submits a CSR. The server's internal CA issues a dedicated client certificate. No external CA dependency.

[mTLS Handshake] TLS_AES_256_GCM_SHA384 · Curve: X25519

Client Cert: CN=device-9821, O=NeoUEM Tenant #4812, Serial=7f3a09b1

Issuer: CN=NeoUEM Fleet Intermediate CA, Validity: 90 Days

✓ Mutual Certificate Verification OK. Client authenticated to tenant boundary.

ECDSA P-256 Signatures

Every command is signed by the tenant private key with nonce dedup and strict 10-minute freshness windows.

Signature Alg ECDSA-SHA256 (P-256) Verified in agent before execution

Hardware TPM 2.0 Escrow

BitLocker and FileVault recovery keys are queried via WMI / libproc and encrypted immediately into tenant KMS storage.

Escrow Coverage 100% Automated Encrypted with AES-256-GCM

PostgreSQL Row-Level Security (RLS)

SaaS multi-tenancy is enforced at the database engine level via PostgreSQL RLS policies. Even in the event of an application logic bug, cross-tenant data access is strictly blocked by the database kernel.

app_tenant Role

Locked into tenant boundary with FORCE ROW LEVEL SECURITY enabled.

Immutable Audit Log

Append-only database triggers capture all security events with client IPs.

Sovereignty First

Secure your entire fleet
with cryptographic precision.

Request a personalized security walkthrough and review our cryptographic threat model documentation with our engineering team.

View Platform Architecture