We built security into every level so you can trust us with your production data on the factory floor.

1. Hardware Root of Trust

• Verified Boot

  UEFI Secure Boot: Ensures the EVAjig only boots with a cryptographically signed, controlled image. A tampered device will not start.

• Read-Only Operating System

  The OS cannot modify itself while running. Only configuration data is writable in a separate, controlled persistent partition.

• Signed, Atomic A/B Updates via RAUC

  Updates are cryptographically signed and written atomically to an inactive partition slot. If something goes wrong, the device automatically boots back to the last known-good slot. No bricks!

2. Network Security

• HTTPS Everywhere: All communication (API, portal, devices) is encrypted exclusively over TLS/HTTPS. Unencrypted HTTP is not used in production.

• ZeroTier Encrypted Remote Access: Remote access for our support is delivered exclusively over a ZeroTier overlay network. This provides end-to-end encrypted VPN-like tunnels, so no SSH port is exposed on your physical network.

3. API Security

The API is the central backbone and enforces security at every layer.

• Three-Context Authentication

  We strictly separate portal users, EVAjig hardware units, and internal services, each with their own token type. Tokens are revocable and carry a hard expiry.

• Argon2id Password Hashing

  Passwords are never stored in plaintext. We use Argon2id—the current recommended standard—for strong hashing.

• Role-Based Access Control

  Access is governed by a six-level role hierarchy (SUPERADMIN > ADMIN > etc.). The system includes explicit protection against privilege escalation.

• Multi-Tenant Data Isolation

  Data from different companies is strictly separated, enforced in middleware on every protected request. You cannot query or modify another company's data.

• Input Validation

  All data sent to the API is validated against a typed schema before any processing occurs.

• SQL Injection Prevention

  All database access uses a parameterized query ORM (Lucid/AdonisJS). Raw SQL is not used, eliminating SQL injection vulnerabilities.

• Bot and Abuse Protection

  Public-facing endpoints are protected by Google reCAPTCHA v3.

• Secrets Management

  All sensitive info (like API keys) is stored exclusively as environment variables, never committed to version control.

• Audit Logging

  Authentication events (including failed login attempts) are recorded. Passwords are automatically redacted from all log output.

• Secure Invite Tokens

  Project invitation tokens are 60-character cryptographically random strings that expire and are destroyed upon use.

4. Web Portal Security

• Session Management

  Your bearer token is validated against the server on every application start; a stale or revoked token results in immediate logout.

• Route Access Control

  Every protected route verifies authentication state. Sensitive administrative areas require the SUPERADMIN role.

• XSS Prevention

  Built on Vue.js, which automatically HTML-escapes all data rendered into templates.

• Minimal Production Container

  The portal is served from a minimal Docker image (only static files and Nginx) for a minimal attack surface.

• Hardcoded Production Endpoints

  The API base URL is embedded at build time, preventing client-side redirection to an alternative server.

5. Production Tool Security (On-Device)

This is the Electron application running on every EVAjig unit.

• Authenticated API Communication

  The tool must always have a valid authenticated session for all communication with the cloud (test configurations, results, firmware, etc.). Unauthenticated clients cannot retrieve any data.

• Electron Process Isolation

  The UI (renderer) runs with nodeIntegration: false and contextIsolation: true, meaning it cannot directly access Node.js or system APIs. Communication happens through a very limited, controlled interface.

• Signed OS Updates, Initiated from the Tool

  The tool initiates the update, but RAUC (at the OS layer) performs the full cryptographic signature verification before applying any update.

• Application Updates from Private Storage

  Application updates are distributed from a private cloud storage bucket with access-controlled credentials.

• Device Identity and Traceability

  Each unit identifies itself to the API by its unique serial number, providing a traceable record.

6. Device Operating System Hardening

• Least-Privilege User Accounts

  The evajig account (running the tool) has sudo access restricted to only poweroff, shutdown, and reboot. It cannot install software or modify system files. The support account is only accessible via the ZeroTier VPN interface.

• PAM Authentication

  The system uses PAM (Pluggable Authentication Modules) for all login contexts, ensuring consistent enforcement of the login policy.

7. Software Supply Chain

• Dependency Management

  Dependency versions are pinned in committed lockfiles (yarn.lock). Docker builds are configured to fail if versions are out of sync.

• Reproducible OS Image

  The OS image is a reproducible Yocto build.