We published a new Trust & Security page covering exactly how AegisFleet protects account access and your fleet's data — authenticator-app MFA, encrypted secrets at rest, HttpOnly session cookies, per-session CSRF protection, and strict tenant isolation where no caller-supplied tenant ID is ever trusted.
It also covers credential handling: API keys and device claim codes are stored only as one-way hashes, webhook payloads are HMAC-SHA256 signed, and every admin action is written to an immutable audit log.
If you're running a security review before signing on, this page — plus our Privacy Policy — should answer most of what you need. Otherwise, just ask.