> ## Documentation Index
> Fetch the complete documentation index at: https://woku.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security and authentication controls implemented in Woku

Woku is designed for enterprise customers that require auditable
controls over who accesses the platform, what they do, and how
information is protected. This section documents the concrete
controls in operation.

## Capabilities overview

| Capability                                              | Status                                         | Page                                                        |
| ------------------------------------------------------- | ---------------------------------------------- | ----------------------------------------------------------- |
| Authentication with persistent session + idle timeout   | ✅ active                                       | [Authentication](/docs/en/seguridad/autenticacion)               |
| Per-user TOTP MFA (opt-in)                              | ✅ active                                       | [MFA](/docs/en/seguridad/mfa)                                    |
| Active sessions visible + revocable by the user         | ✅ active                                       | [Sessions](/docs/en/seguridad/sesiones)                          |
| Per-company audit log with CSV export                   | ✅ active                                       | [Audit log](/docs/en/seguridad/audit-log)                        |
| Anti brute force lockout + email notification           | ✅ active                                       | [Anti brute force](/docs/en/seguridad/anti-brute-force)          |
| Security HTTP headers (HSTS, CSP nonce, etc.)           | ✅ active                                       | [Headers and CSP](/docs/en/seguridad/headers-y-csp)              |
| Per-company IP allowlist (CIDR IPv4 + IPv6)             | ✅ active                                       | [IP allowlist](/docs/en/seguridad/ip-allowlist)                  |
| Enterprise SSO (SAML 2.0 + OIDC via Stytch)             | ✅ active                                       | [SSO](/docs/en/seguridad/sso)                                    |
| Secrets management (SSM Parameter Store + KMS)          | ✅ active                                       | [Secrets management](/docs/en/seguridad/secrets-management)      |
| AES-256-GCM encryption at rest + HMAC-SHA256 signatures | ✅ active (document signing opt-in per company) | [Encryption and signatures](/docs/en/seguridad/cifrado-y-firmas) |

## Principles

* **Defense in depth**: each layer has its own protection
  (transport with HSTS, routing with CSP, session with idle timeout, account
  with anti brute force, sensitive actions with MFA).
* **Auditability**: every critical action (login, company changes,
  CRUD on wokus and forms, etc.) is logged with actor, IP,
  user-agent, and timestamp.
* **Encryption at rest**: sensitive secrets (TOTP secrets, integration
  tokens) are stored encrypted with AES-256-GCM.
* **Least privilege**: MFA backup codes are bcrypt
  hashes; refresh tokens are rotating and single-use.

## How to report a vulnerability

Write to `team@woku.app` with the details. We respond within
24 business hours, **or according to the SLA agreed in your Corporate contract**.