# Witina AI — Security

> Device credentials are never stored in Witina's cloud. The gateway only dials out.
> Discovery is passive by default. Configuration changes can go through approvals, and
> are snapshotted first, verified after and reversible.

Source: https://witinaai.com/ai/security.md
Part of the Witina AI machine-readable corpus — index: https://witinaai.com/llms.txt
Last updated: 2026-10-20
Human version: https://witinaai.com/security/

## The approach

Witina reads your topology and pushes configuration to live gear, so its safeguards are
part of the architecture: device credentials stay encrypted on a gateway in your network,
the gateway only dials out, and a configuration change is snapshotted before it touches a
device.

## Credentials

**Witina does not store your device credentials.** When you add one in the console it is
relayed over TLS to a gateway on your own network and kept encrypted there, on
infrastructure you run.

| Where | What exists there |
|---|---|
| In Witina's cloud | **Device passwords are not stored here.** |
| In transit | Relayed to your gateway over TLS, held in memory, then written only to the gateway — encrypted. |
| At rest | On a gateway you run. Self-host and even the transit stays on your LAN. |

Encryption at rest on the gateway uses a wrapped-key (keyslot) model with three policies
you choose between per gateway: **TPM-sealed**, **SaaS-assisted** (key split between
gateway and cloud, so neither a stolen gateway nor a cloud breach decrypts alone), or a
**local key file**. De-authorizing a SaaS-assisted gateway withholds the cloud's share,
making its data cryptographically unrecoverable — a crypto-shred that does not require
recovering the hardware. Full detail: https://witinaai.com/ai/architecture.md

## Network exposure

- **No inbound ports.** The gateway makes an outbound TLS connection, and everything
  between it and the cloud rides over it. You never expose a management plane to the internet.
- The gateway proves its identity with a signed token; it is provisioned once with a
  pairing token and renews itself.

## Gateway privilege

- Runs as an **unprivileged user**, not root, with a handful of narrow Linux capabilities —
  enough to sniff packets for discovery, serve firmware on one port and carry the VPN's
  tunnels. A compromise of the
  gateway process is not a root shell on your router.
- Reboots and image upgrades go through a separate, API-mediated path.
- **Scoped credentials**: you decide which credentials may touch which devices. Access is
  an auditable mapping, not a global admin blob.

## Discovery is quiet by default

Bringing a network online should not set off your own alarms. Discovery starts **passive**
— listening to DHCP, LLDP/CDP and mDNS rather than scanning. Active probing and
auto-connect are **opt-in** decisions you make per network.

## Change safety

Configuration changes are not anonymous, irreversible edits. Each one can be routed
through approvals, **snapshots the device's current state before touching anything**,
verifies the result, and can be **rolled back** to the snapshot — with a complete audit log
of who did what, when and why.

Remote sessions leave a record too. Opening a terminal or a device's web interface is its
own permission, checked against the scope you are acting in. The gateway logs in with the
stored credential, so the password never reaches your browser. Terminal sessions are
recorded from what the device sends back, which keeps a password typed at a hidden prompt
out of the recording, and opening and closing one is logged.

## Technician VPN

- **Default deny.** Nobody connects until a policy names their team. Roles decide who can
  see and change policies; no role lets anyone connect by itself.
- **Enforced at the gateway.** Each session has its own allow set on the gateway (the site's
  networks and an end time). The gateway drops everything else and holds the end time
  itself, so a session that loses touch with the cloud still closes on schedule.
- **No inbound ports here either.** The gateway sends first, toward each technician, and the
  tunnel comes back through the opening that makes in its own NAT.
- **Traffic stays off Witina's cloud.** The cloud brokers the connection; the WireGuard
  tunnel runs directly between the technician's computer and the gateway. The computer
  makes its own key, and the key never leaves it. VPN traffic is not recorded.
- **Flow records** of every connection (when, destination, bytes, and the gateway's port as
  the site logged it), kept per organization for 90 days by default. Sessions, policy
  changes and turning the VPN on or off are in the activity log.
- **A link only your own app should open.** The app joins an account through a link it opens
  in the browser. If the browser's address or operating system doesn't match the app's,
  Witina shows a warning, and no site turns on until the person confirms it is their own app.

## Tenancy and identity

- **Multi-tenant isolation** via an Organization / Division / Region hierarchy that scopes
  every record. Access is checked **per request** against the scope you are acting in.
- **Bring your own identity**: OIDC / OAuth (Authorization Code + PKCE), configured
  globally or per organization.
- **Activity logging** records user actions, separately from device audits.

## AI agent access

Witina exposes an MCP server so external AI agents can read network state and draft
changes. The authorization model is deliberately conservative:

- An agent authenticates via **OAuth 2.1** — PKCE S256 mandatory, exact redirect matching,
  opaque tokens stored hashed, short-lived access tokens, rotating refresh tokens with
  reuse detection, and RFC 8707 audience binding so a token minted for another resource is
  rejected.
- An agent's effective permissions are its granted role **intersected with the current
  permissions of the human who authorized it**, in one pinned context — recomputed on every
  request, not baked into the token.
- Four independent conditions drop it to zero permissions: revocation, the authorizing
  user's credential change (a password reset kills every agent they authorized), that user
  losing organization access, or a context mismatch.
- Of nine tools, **only two can write, and both write only into a draft** change
  management that a human must run.

Full model and complete tool schemas: https://witinaai.com/ai/mcp.md and
https://witinaai.com/mcp/tools.json

## Certification

**There is no third-party security certification yet**: no SOC 2 report and no ISO
certificate.

Security questions: hello@witinaai.com

## Related

- Architecture: https://witinaai.com/ai/architecture.md
- Privacy policy: https://witinaai.com/privacy/
- Terms of service: https://witinaai.com/terms/