TorkSecurity Documentation

Security-First AI Governance

Tork is built from the ground up with security as a core principle. We protect your AI applications with production-grade security controls, comprehensive input validation, and continuous monitoring.

Trust CenterReport a Vulnerability
AES-256
Encryption
1.3
TLS Version
ES256
Token Algorithm
In Progress
SOC 2 Type II

Tork supports multiple authentication methods to secure your API access, from simple API keys to production-grade JWT tokens with automatic rotation.

API Key Authentication

Secure API keys with SHA-256 hashing, automatic rotation support, and granular scoping.

  • Keys prefixed with tork_ for easy identification
  • SHA-256 hashing - raw keys never stored
  • Automatic last-used tracking
  • Revocation support with immediate effect

JWT Authentication

Industry-standard JWT tokens using ES256 (ECDSA) algorithm for maximum security.

  • ES256 algorithm (ECDSA with P-256 curve)
  • 15-minute access token TTL
  • 7-day refresh tokens with rotation
  • JTI-based token revocation
  • IP binding and device fingerprinting

OAuth Integration

Seamless authentication via trusted identity providers.

  • Google OAuth 2.0
  • GitHub OAuth
  • Secure state parameter validation
  • PKCE support for mobile apps

Multi-dimensional rate limiting protects against abuse while ensuring fair usage across all customers. Limits are enforced per IP, API key, organization, and endpoint.

Subscription Tier Limits

Free
60
per minute
Starter
120
per minute
Pro
300
per minute
Enterprise T1
1,000
per minute
Enterprise T2
2,000
per minute
Enterprise T3
Unlimited

Protection Features

Sliding Window
Smooth rate limiting without sudden cutoffs
Progressive Lockout
Escalating delays for repeated violations
Retry-After Header
Proper 429 responses with retry timing
Real-time Monitoring
Live dashboard for rate limit status

All API inputs are validated against known attack patterns before processing. Our validation layer blocks common injection attacks and enforces strict data formats.

SQL Injection

Blocks UNION SELECT, DROP TABLE, and other SQL injection patterns

SELECT * FROM users; DROP TABLE--
XSS Prevention

Prevents script injection, event handlers, and encoded payloads

<script>alert("xss")</script>
Command Injection

Blocks shell commands, pipe operators, and command chaining

; rm -rf / && cat /etc/passwd
Path Traversal

Prevents directory traversal and file system access attempts

../../../etc/passwd

Additional Validations

JSON depth limits (max 10)Array length limits (max 1000)String length limitsUTF-8 validationNull byte detectionControl character blockingZero-width character removalEmail format validation (RFC 5322)URL scheme validationPrototype pollution prevention

Server-Side Request Forgery (SSRF) protection blocks attempts to access internal resources, cloud metadata endpoints, and private network ranges.

Private IP Ranges

  • 10.0.0.0/8 (Class A private)
  • 172.16.0.0/12 (Class B private)
  • 192.168.0.0/16 (Class C private)
  • 127.0.0.0/8 (Loopback)
  • 169.254.0.0/16 (Link-local)

Cloud Metadata Endpoints

  • AWS: 169.254.169.254
  • GCP: metadata.google.internal
  • Azure: 169.254.169.254
  • DigitalOcean: 169.254.169.254

Additional Protections

  • DNS rebinding prevention
  • Redirect chain limits
  • Protocol validation (HTTPS only)
  • Port restrictions

All responses include security headers that protect against common web vulnerabilities and enforce secure communication.

Content-Security-Policydefault-src 'self'; script-src 'self' 'unsafe-inline'...

Prevents XSS and data injection attacks

X-Frame-OptionsDENY

Prevents clickjacking by blocking iframe embedding

X-Content-Type-Optionsnosniff

Prevents MIME type sniffing attacks

Strict-Transport-Securitymax-age=31536000; includeSubDomains

Enforces HTTPS connections

Referrer-Policystrict-origin-when-cross-origin

Controls referrer information leakage

Permissions-Policycamera=(), microphone=(), geolocation=()

Restricts browser feature access

Your data is protected at every stage with encryption, access controls, and compliance certifications.

Encryption

Industry-standard encryption for all data

  • TLS 1.3 for data in transit
  • AES-256 encryption at rest
  • Secure key management
  • Perfect forward secrecy

PII Protection

Automatic detection and redaction of sensitive data

  • Real-time PII detection
  • Configurable redaction rules
  • Support for 50+ PII types
  • Audit trail for all redactions

Compliance

Meeting enterprise security standards

  • GDPR compliant (DPA available)
  • HIPAA ready (BAA available)
  • CCPA compliant
  • SOC 2 Type II (in progress)

Comprehensive security event logging with threat scoring, alerting, and SIEM integration support.

Authentication
Login attempts, token validation, key usage
Authorization
Permission checks, scope validation
Rate Limiting
Threshold breaches, lockouts
SSRF Attempts
Blocked internal requests
Injection Attacks
SQL, XSS, command injection attempts
PII Detection
Sensitive data handling events

Features

Real-time event streamingThreat score calculationConfigurable alert thresholdsSIEM integration (JSON, CEF, LEEF)90-day log retentionActor threat scoringGeolocation trackingRequest correlation IDs

Responsible Disclosure

We take security seriously and appreciate responsible disclosure of vulnerabilities. If you discover a security issue, please contact us privately.

security@tork.network
Bug Bounty Program — Coming Soon

Please allow up to 48 hours for an initial response. We will work with you to understand and resolve the issue promptly.

Ready to Secure Your AI?

Join developers building trustworthy AI systems with Tork.

Get Started Free Star on GitHub