generated: '2026-08-10'
method: searched
source: https://amuncore.com/security.html
description: >-
  AmunCore publishes a dedicated, public security and data-protection page written
  for evaluation — hosting model, per-channel protections, encryption, access
  control, auditing, and an explicitly labelled "Honest roadmap" of what is not yet
  implemented. It is a trust page in substance, not a badge wall: it names zero
  certifications and says so.
trust_page: https://amuncore.com/security.html
certifications: []
attestations: []
certification_note: >-
  No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP certification is claimed. The
  provider states independent penetration testing and ISO 27001 alignment are on
  the roadmap and not implemented. For regulated buyers it recommends an
  on-premises install plus a joint security review with the customer's own team.
hosting_models:
- model: self-hosted
  description: >-
    Install on the customer's own servers behind their firewall, connecting to
    their databases with credentials they control. Data never leaves their
    environment. Positioned for banks, enterprises and regulated industries.
- model: managed-cloud
  description: Hosted platform with strict per-company isolation of applications, endpoints and data.
data_handling:
  copies_customer_records: false
  statement: >-
    "We never copy, export, or store your database records. AmunCore acts as a
    controlled access layer in front of your data."
channel_controls:
- channel: REST API
  controls: >-
    Per-application API key on every request; parameterized queries; rate
    limiting; optional IP whitelisting; full audit logging.
- channel: GraphQL
  controls: >-
    Resolved by application ID plus API key together; per-endpoint authentication;
    only explicitly exposed fields are queryable.
- channel: AI / MCP
  controls: >-
    Gated by a separate secret token distinct from the REST API keys; scoped to a
    single company; same audit logging; can be disabled entirely per company.
- channel: Webhooks
  controls: HMAC-SHA256 signed payloads; delivery attempts logged.
encryption:
  at_rest: AES-256 for database connection strings and other secrets, including two-factor secrets.
  in_transit: HTTPS/TLS; TLSv1.3 and HSTS max-age 2592000 observed live.
  integrity: License keys and webhook payloads signed with HMAC-SHA256.
access_control:
  password_storage: BCrypt
  mfa: Optional TOTP 2FA with one-time recovery codes and administrator reset
  roles: [SuperAdmin, Admin, Developer, Viewer]
  tenant_isolation: Strict per-company separation enforced on every request
sql_injection:
  posture: >-
    All database access uses fully parameterized queries across table endpoints,
    stored-procedure endpoints and every supported engine; user input is never
    concatenated into SQL.
auditing:
  request_log_fields: [method, path, status_code, response_time, source_ip]
  analytics: Real-time usage, error-rate and latency analytics
  webhook_delivery: Delivery attempts and outcomes recorded
published_roadmap_gaps:
- Single sign-on (OAuth2 / SAML) and social login — not implemented
- Audit-log export to external SIEM systems — not implemented
- Independent penetration testing and ISO 27001 alignment — not implemented
vulnerability_disclosure:
  policy_url: null
  security_txt: null
  bug_bounty: null
  contact: sales@amuncore.com
  note: >-
    There is no vulnerability-disclosure policy, no /.well-known/security.txt and
    no bug-bounty program. The only security contact is the general sales address
    offered for enterprise review, which is not a disclosure channel — a
    researcher has no published route to report a finding. No VulnerabilityDisclosure
    artifact or Security pointer is emitted, because none exists to point at.
disclaimer: >-
  The page states it "is a summary for evaluation purposes and does not constitute
  a security warranty."
evidence:
- url: https://amuncore.com/security.html
  status: 200
- url: https://amuncore.com/.well-known/security.txt
  status: 404