Security model
Built for environments you don’t control
Aegis Secure View assumes the host is hostile. Four independent layers protect the customer’s documents, the platform’s intellectual property, and the integrity of every access decision.
# attacker: root access on host obtained
$ docker exec aegis -- sh
sh: not found
$ ls /
aegis-cloud-api etc usr
$ strings /aegis-cloud-api | head
symbols stripped · LTO fat build
$ curl localhost/api/...
→ { "lease": "valid", "signature": "Ed25519" }
nothing to extract · nothing to execute
$
Layer 01 · Zero-leak binary distribution
The platform defends itself
On-premise software traditionally trusts the machine it runs on. Aegis Secure View does not. The entire application is delivered through a hardened, multi-stage compilation pipeline designed to keep intellectual property sealed even in a hostile data center.
Embedded frontend
The React single-page application is compiled and injected directly into the Rust binary’s .rodata segment. There are no HTML, JavaScript, or CSS files on disk to copy, modify, or inspect.
Compiler-level obfuscation
The backend is built with link-time optimization set to "fat" and all symbols stripped. The result is an opaque, heavily optimized machine-code executable with no meaningful reverse-engineering surface.
Distroless, shell-less runtime
The production image is built FROM scratch. It contains no shell, no package manager, and no utilities. The container filesystem is completely inert, and docker exec attacks have nothing to latch onto.
Layer 02 · Frictionless EDRM
The document never crosses the wire
Traditional viewers send the PDF to the client and hope for the best. Aegis Secure View inverts that model: rendering happens server-side, in memory, and only sealed pixels ever leave.
In-memory rasterization
PDFs are rendered directly to memory buffers on the server. Vector content, embedded fonts, metadata, and file structure remain on the host at all times.
Forensic watermarking
Every frame receives a dynamic, pixel-level watermark that is forensically identifiable, traceable back to the specific user and session that requested it.
Stream-only delivery
The client receives the sealed raster stream and nothing else. The original vector PDF is never transmitted over the network: not cached, not downloadable, not inspectable.
Layer 03 · Aegis Shield (ASP)
Deterministic, auditable access control
Aegis Shield is a JSON-based policy engine that decides exactly who can do what, on which resource. No ambiguity, no hidden state.
Granular overrides
Action/resource permissions can be overridden on a per-user or per-group basis, layered over strict role-based access control in the Virtual File System.
Deterministic evaluation
The same policy input always produces the same decision. Access outcomes are reproducible and straightforward to audit.
Storage abstraction
Physical SAN/NAS storage is mapped into logical, policy-governed folders. Clients never touch, or even see, the underlying filesystem layout.
Layer 04 · Licensing control plane
Cryptographic leases, graceful enforcement
Every deployment operates under an active, cryptographically signed JWT lease issued by the Aegis Cloud Services control plane, acting as the certificate authority.
Embedded trust anchor
An Ed25519 public key is embedded in the application’s machine code. On boot, the platform authenticates against the control plane. No key files, no configuration to tamper with.
Graceful degradation
If a lease expires, the application enters a read-only mode automatically. Users keep visibility of their documents; the rights envelope stays sealed.
Want to see it hold up live?
We deploy a demonstration instance inside your own environment and walk through every layer, including the ones you can try to break.