Network Security

The Vault is built on zero-trust networking: no component trusts another by default, and every connection is authenticated and encrypted.

Principles

• Mutual TLS everywhere — all service-to-service traffic uses mTLS with verified certificates; there is no implicit trust based on network location.
• Authenticated signer channels — signer-to-signer communication is mutually authenticated and forward-secret.
• Isolation — signing components are network-isolated from general workloads; the coordinator only relays messages and holds no key material.
• Least privilege — access is scoped per profile and per role at the gateway, with rate limiting and IP controls at the edge.

Device Certificates

Mobile signer devices authenticate with X.509 certificates issued by The Vault’s internal CA. A lost or stolen device is blocked from the dashboard, which logs it out and excludes it from signing (see Device Management).