Security is not a feature.
It's the foundation.
Every layer of VyXlo was designed under the assumption that documents are mission-critical assets. Cryptographic integrity, zero-trust access, and immutable logging — by default, not by configuration.
Security Architecture
ZITADEL OIDC / PKCE
All identity delegated to ZITADEL — no passwords stored in VyXlo. OAuth 2.0 PKCE flow with MFA (TOTP, SMS), passkeys/WebAuthn, SSO via SAML 2.0, and LDAP/AD federation.
Immutable Audit Trail
Every action (CREATE, UPDATE, DELETE, ACCESS, DOWNLOAD, PERMISSION_CHANGE, WORKFLOW, EXPORT) recorded with actor, resource, timestamp, before/after diff, and IP address.
MinIO Presigned Downloads
File bytes never flow through the API server. Downloads are served as 15-minute presigned MinIO URLs. Server-side encryption on all stored objects. SHA-256 checksums detect tampering.
8-Level Permission Model
Resource permissions (NONE → READ → DOWNLOAD → COMMENT → CONTRIBUTOR → WRITE → EDITOR → ADMIN) applied independently per document and per folder. Optional expiry for time-bounded grants.
Soft-Delete Architecture
No data permanently destroyed without explicit ADMIN action. Soft-deleted documents remain in DB and are recoverable. Retention policies per document with automated expiry enforcement.
Multi-Tenant Isolation
Shared database with org_id isolation enforced at ORM level on every query — never optional, never bypassable by client input. Rate limiting via slowapi. CORS policy enforced.
Role Hierarchy & Resource Permissions
7-level role hierarchy (hierarchical, each role inherits below) + 8-level resource permission model applied independently per document and per folder.
| Role | Level | Scope |
|---|---|---|
| SUPER_ADMIN | 100 | Cross-org platform operator |
| ADMIN | 80 | Full org control |
| MANAGER | 60 | Department head, approver |
| EDITOR | 40 | Power content creator |
| USER | 20 | Standard knowledge worker |
| VIEWER | 10 | Read-only stakeholder |
| GUEST | 5 | External via invite or share link |
| Permission | View | DL | Edit | Delete | Share | Manage |
|---|---|---|---|---|---|---|
| NONE | — | — | — | — | — | — |
| READ | ✓ | — | — | — | — | — |
| DOWNLOAD | ✓ | ✓ | — | — | — | — |
| COMMENT | ✓ | ✓ | — | — | — | — |
| CONTRIBUTOR | ✓ | ✓ | ✓ | — | — | — |
| WRITE | ✓ | ✓ | ✓ | — | ✓ | — |
| EDITOR | ✓ | ✓ | ✓ | ✓ | ✓ | — |
| ADMIN | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Security documentation available.
Download our full security whitepaper or talk to our architects.