Security model
Built for environments you don’t control
Aegis Secure View assumes the host is hostile. Five independent layers protect the customer’s documents, the platform’s intellectual property, and the integrity of every access decision.
# attacker: root access on host obtained
$ docker exec aegis -- sh
sh: not found
$ ls /
aegis-cloud-api etc usr
$ strings /aegis-cloud-api | head
symbols stripped · LTO fat build
$ curl localhost/api/...
→ { "lease": "valid", "signature": "Ed25519" }
nothing to extract · nothing to execute
$
Layer 01 · Zero-leak binary distribution
The platform defends itself
On-premise software traditionally trusts the machine it runs on. Aegis Secure View does not. The entire application is delivered through a hardened, multi-stage compilation pipeline designed to keep intellectual property sealed even in a hostile data center.
Embedded frontend
The React single-page application is compiled and injected directly into the Rust binary’s .rodata segment. There are no HTML, JavaScript, or CSS files on disk to copy, modify, or inspect.
Compiler-level obfuscation
The backend is built with link-time optimization set to "fat" and all symbols stripped. The result is an opaque, heavily optimized machine-code executable with no meaningful reverse-engineering surface.
Distroless, shell-less runtime
The production image is built FROM scratch. It contains no shell, no package manager, and no utilities. The container filesystem is completely inert, and docker exec attacks have nothing to latch onto.
Layer 02 · Frictionless EDRM
The document never crosses the wire
Traditional viewers send the PDF to the client and hope for the best. Aegis Secure View inverts that model: rendering happens server-side, in memory, and only sealed pixels ever leave.
In-memory rasterization
PDFs are rendered directly to memory buffers on the server. Vector content, embedded fonts, metadata, and file structure remain on the host at all times.
Forensic watermarking
Every rendered frame receives a dynamic, pixel-level watermark attributable to the user and session that requested it — with an administrator-defined template ({COMPANY_NAME}, {USERNAME}, {FULL_NAME}, {EMAIL}, {IP_ADDRESS}, {TIMESTAMP}) and opacity adjustable from 5% to 50% (12% by default).
Stream-only delivery
The client receives the sealed raster stream and nothing else. The original is downloadable only where a Shield policy grants raw download; every other view stays as protected pixels — never cached, never delivered.
Client-side content guards
For non-administrators, right-click menus, drag-to-desktop of rendered pages, and Ctrl/Cmd+S are suppressed at the capture phase; desktop file drops outside upload zones are refused; and an off-main-thread anti-tamper worker watches for debugger interference.
Layer 03 · Aegis Shield (ASP)
Deterministic, auditable access control
Aegis Shield decides exactly who can do what, on which resource — assembled as a visual rule set or as JSON, versioned and evaluated deterministically. No ambiguity, no hidden state.
Granular overrides
Policies are built in a visual rule builder — Allow and Deny statements over actions and resources — with a read-only JSON view for review and version control. System policies are immutable; custom policies clone and evolve.
Deterministic evaluation
The same policy input always produces the same decision, and any Allow statement can additionally require a second factor through the MultiFactorAuthPresent condition. Access outcomes are reproducible and straightforward to audit.
Storage abstraction
Physical SAN/NAS storage is mapped into logical, policy-governed folders. Clients never touch, or even see, the underlying filesystem layout.
Folder-level ACLs
Grant or deny users, groups, or public access across nine actions — list, view, download raw, print, create, modify, delete, change permissions, lock — scoped to a folder, its children, or both, with optional expiry. Inheritance can be deliberately broken and restored.
Effective access simulator
Before a policy ships, simulate it: point the calculator at any user or group and any VFS path to get the full capability matrix plus a decision trace — super admin, direct ACL, or inherited ACL.
Network context rules
CIDR-based IP rules add context to every request: bypass Turnstile or 2FA for trusted ranges, auto-assign a group or a Shield policy — with server-IP auto-detection and a rule tester.
Layer 04 · Licensing control plane
Cryptographic leases, graceful enforcement
Every deployment operates under an active, cryptographically signed JWT lease issued by the Aegis Cloud Services control plane, acting as the certificate authority.
Embedded trust anchor
An Ed25519 public key is embedded in the application’s machine code. On boot, the platform authenticates against the control plane. No key files, no configuration to tamper with.
Graceful degradation
If a lease expires, the application enters a read-only mode automatically. Users keep visibility of their documents; the rights envelope stays sealed.
Offline & hardware-bound
Licenses bind to the instance hardware ID and can be activated, transferred, or deactivated for hardware migration. Air-gapped deployments run on a static offline lease with no control-plane sync.
Layer 05 · Identity & accountability
Every decision leaves a record
Identity and evidence close the loop: a second factor that cannot be skipped, devices that expire, and an audit trail the console cannot erase.
Mandatory 2FA
Two-factor authentication can be enforced for everyone and mandated per user. Administrators must bind TOTP before reaching the console, and an interrupted user returns to the exact page that triggered the challenge.
Trusted devices with an expiry
Users may skip the second factor only on devices they trust, and only within the window the administrator sets — 1 to 365 days, 180 by default. Changing a password revokes them all.
Audit you can inspect
47 typed events — 27 of them administrative — cover sign-ins, document views, uploads, downloads, and policy changes. Filter by date, actor, or event, inspect the JSON metadata behind any entry, or export the full log to CSV.
Want to see it hold up live?
We deploy a demonstration instance inside your own environment and walk through every layer, including the ones you can try to break.