_edited.png){kind=logo}
_edited.png)
AI Portus
Security Standards
Security
OAuth 2.0
OAuth enhances security by providing a more secure and controlled way to grant and manage access to resources, reducing the risks associated with traditional authentication and authorization methods.
AI Portus can integrate with any Identity Provider (IDP) implementing the OAuth standard. We configure the service for each client’s specific security integration requirements at the time of Onboarding.
Authentication and Access
_edited.jpg)
Authentication of Users and Access to Runtime Environments works as follows:
-
Users Login credentials are redirected to IDP for Authentication
-
Once Authentication occurs, the IDP sends an Authorization Code
-
AI Portus requests the IDP to exchange the Authorization Code for a JWT
-
IDP validates the Authorization Code and returns a valid JWT
-
AI Portus sets the JWT into the HTTP Authorization Header and sends requests to the Design Environment
-
The Design Environment validates that the JWT is valid, processes the API request and returns the response to AI Portus.
JSON Web Key Set (JWKS): When each environment is started, it downloads a JWKS from the IDP which is used to validate JWTs sent to the environment.
API Accessors
_edited.jpg)
For Applications attempting to access AI Portus APIs the process is as follows:
-
The API Accessor redirects to IDP for Authentication
-
Once Authorization occurs, the IDP returns an Authorization Code
-
The API Accessor requests the IDP to exchange the Authorization Code for a JWT
-
IDP validates the Authorization Code and returns a valid JWT
-
The API Accessor then sets the JWT into the HTTP Authorization Header and sends requests to the Design Environment. (Where the UI must access the other Environments, this token must also be provided).
-
The Design Environment validates that the JWT is valid, processes the API request and returns the response to AI Portus.
Standards
ISO 27001:2002 & CIS
.png)
ISO 27001:2002
Ostia adheres to the ISO 27001:2022 standard and has implemented a systematic approach to managing sensitive company and customer information, including:
-
Risk Management: Identifying, assessing, and mitigating risks to your data
-
Continuous Improvement: Regularly updating our security practices to address emerging threats
-
Compliance: Meeting stringent regulatory and legal requirements.
CIS Benchmark Standards
We align our security practices with the Center for Internet Security (CIS) Benchmarks in order to:
-
Harden Systems: Implementing configurations that reduce vulnerabilities
-
Ensure Consistency: Standardizing security measures across our environment
-
Enhance Visibility: Providing clear insights into our security posture
.png)