Security posture
Access control is only as strong as the platform beneath it
NG-Key is built so that door security, credential security, and administrative security reinforce each other. A tap at the door, a Wallet QR presentment, or a Passkey confirmation should sit on the same foundations: isolated tenants, strong identity, protected key material, trusted devices, and auditable change.
This whitepaper describes the controls operators and partners can rely on when evaluating NG-Key for production use. It states what the platform enforces — not a certificate claim and not a promise about third-party silicon or customer configuration.
Isolation
Tenant boundaries that fail closed
Tenant-owned data is queried and mutated only inside the current tenant. Structural tenant scopes and ownership guards apply across access grants, devices, facility, credentials, visitors, and related domains. Cross-tenant identifiers are not disclosed in errors or UI.
Authorization uses policies, FormRequests, and RBAC modules. Platform-critical settings remain gated separately from tenant administration.
- Route and query scoping by tenant with 404 on forbidden access
- Foreign-key validation constrained to the acting tenant
- Escape hatches for jobs and shared-door evaluation are deliberate and review-gated
Identity
Passkeys, OIDC, and administrative hygiene
Passkeys and WebAuthn
Product Passkeys and Access QR flows use WebAuthn for human authentication. Sensitive station actions can require mobile Passkey step-up.
Keycloak OIDC
Portal login can require Keycloak with passkey-first realm options, rate-limited redirect and callback paths, and controlled local-password break-glass.
Invitation and offboarding
Team invitations, ownership, and role assignment are explicit so dormant administrators do not retain silent privilege.
Credentials & keys
Media Access-IDs and protected key material
PhysicalCredential records are the source of truth for Access-IDs used at doors. Encoding bridges into stewardship so card serial provenance does not become a second permission world.
Card key references and related payloads are encrypted at rest. Reseller template push can require encrypted key transport. Managed key custody and SE root ceremony paths keep high-value material out of application UI and logs. LEGIC Trusted Service profiles keep LEGIC key material in the Trusted Service while NG-Key stores tenant profile identifiers and encrypted VCP artifacts.
- Encrypted key references and token payloads on credential definitions
- No raw claim tokens, MQTT passwords, or telemetry secrets in application logs
- hash_equals for API tokens, ingest secrets, and machine credentials
Device trust
Claim, certificates, hardware trust, and signed updates
Enrollment claim
Devices enroll through time-bounded claim material. Enrollment QR visibility respects claim windows so expired claims do not silently bootstrap.
MQTT mTLS
Cloud and local brokers authenticate devices by client certificate fingerprint bound to managed, edge, or IO records, and support password principals where certificate authentication is not configured.
Hardware trust
Edge heartbeats report hardware trust posture into fleet views so operators can see attestation status alongside connectivity.
Signed OTA
Firmware and agent packages follow signed distribution paths from manufacturing release authority through platform mirroring.
Door decisions
Local evaluation with cloud audit integrity
Physical policy is published to the door path; local decisions are not re-run in the cloud for the tap itself. Ingest of local_access_decision events is idempotent and audit-oriented.
Wallet QR presentment uses signed barcodes and allow-list serials. Product Passkeys remain cloud-evaluated. Elevator and IO relay paths fail closed on offline IO, stale telemetry, unverified wiring, or active critical safety conditions.
Evidence
Audit trails and ledger-backed records
Security-relevant actions — grants, credential lifecycle, device share events, privileged administration — are recorded for operators. Ledger events support integrity for provisioning and commercial handovers where configured.
Observability exports use aggregate labels only. Tenant IDs, user IDs, and payload contents are not used as metric labels.
Delivery quality
Protected change before production runtime
Stronger production security starts before runtime: untrusted change does not reach customer fleets without automated quality gates.
- CI gates for style, static analysis, tests, dependency audits, and container scanning
- Validated git delivery and controlled production deploy workflows
- Configuration defaults that fail closed for critical encryption and plaintext-transport protections
European posture
Hosting, CRA engineering posture, and ISMS alignment
NG-Key production application hosting and related platform services operate in the European Union. Public CRA materials describe engineering posture and secure-update practices; they do not present a certificate.
ISMS documentation maps governance, identity, operations, monitoring, and evidence controls used to run the platform. That alignment supports customer due diligence without substituting for the customer’s own certification program.
Shared responsibility
Platform controls and customer configuration
NG-Key provides isolation, authentication, device trust, key protection, and evidence. Customers and partners remain responsible for accurate grants, timely offboarding, physical mounting, network segmentation at the site, and correct use of identity federation settings.
Security is strongest when platform controls and site operations are both deliberate: least privilege in the workspace, verified wiring in the field, and monitored trust posture across the fleet.