— SECURITY
Fail-closed by design, provable by default.
Security in Lore isn't a checklist bolted on afterward — the same enforcement that keeps agents safe generates the evidence that proves it. When authority is absent, nothing runs.
IDENTITY & ACCESS
Role-based access control
Member, admin, and super-admin tiers; organization and team membership with role differentiation; project-level access through explicit membership.
JWT with rotation
Access and refresh tokens with rotation; bcrypt password hashing; service-account authentication for agent-to-platform communication.
Row-level tenant isolation
Row-level security for multi-tenant data isolation, with project context boundaries enforced at the query layer.
Machine identity
Auth methods for Kubernetes, AWS, GCP, Azure, and OIDC; identity tokens for service-to-service authentication.
Agent credential binding
Each agent gets isolated service-account credentials; secret and policy bindings constrain access; all credential material rotates on decommission.
Scoped, single-use approval
Destructive operations require approval tokens bound to scope and usable exactly once — issued by a distinct authorized checker.
DATA PROTECTION
Encryption everywhere
TLS in transit, encryption at rest, secret values encrypted with environment separation and version history.
Fail-closed secrets
Secrets resolve by reference through a controlled authorization layer — metadata visible, values gated. No plaintext enforcement is on by default.
Cryptographic erasure
Provable deletion via per-unit key destruction, with a receipted, offline-verifiable record of what was destroyed.
Redaction policies
Sensitive content is redacted before entering long-term analytical storage; disclosure to models is policy-controlled per destination.
Input validation
Schema validation across the API surface, SQL parameterization, sanitized user content, strict CORS, and hardened HTTP headers.
Native key custody
Built-in PKI and KMS; BYOK and HSM custody on the enterprise tier with managed receipt-key rotation.
EVIDENCE & AUDIT
Signed receipts
Every governed action, memory mutation, and compiled context produces a canonical receipt dual-signed with Ed25519 and HMAC-SHA256.
Tamper-evident chains
Receipts hash-chain into an insert-only store. An offline verifier reports VALID, TAMPERED, or INVALID with no database access.
Complete audit trails
Secret access, configuration changes, capture directives, memory access events, and agent operations — all logged with attribution.
IDENTITY
Agents get identities, not shared keys.
People, agents, service accounts and external credentials live in one directory, with roles at every scope (owner, admin, editor, member, viewer, guest), so every action is attributable to a principal you can see and revoke.
POSTURE
Turn enforcement on at your pace.
Egress policy, scope authorization, API authentication and receipt-signing enforcement are switches on one admin panel, set where they belong. Start permissive, then harden workflow by workflow.
SECRETS
Secrets that go where your code runs.
—Secret sync to env files, etcd, GitHub, GitLab, Vercel, AWS Secrets Manager and Amazon S3
—Certificate sync to AWS Certificate Manager and Azure Key Vault
—PostgreSQL and Redis credential rotation
—LLM key health checks
—Secret scanning, an SSH certificate authority, and just-in-time privileged access
Ask us the hard questions.
Security reviews welcome — we'd rather show you the receipts.
Contact securityLore
Context is all you need.
Built by Neurabyte.
Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.