Security model
Zelikore is the shared control plane for human identity, organizations, memberships, product entitlements, subscriptions, billing, and universal AI tokens. It does not absorb each product's operational data. Every request must be accepted by the product that owns the destination data and action.
- Access is denied when identity, audience, scope, workspace, or service-link context does not match.
- Cross-product mutations are designed to be explicit, versioned, and idempotent.
- Async work uses events and queues where durability and retry matter.
Identity and access
Google sign-in is the primary account path. Email/password accounts remain first-class. When a person later signs in with Google using the same verified email address, the verified identity is attached to the same stable Zelikore account instead of creating a second person.
Product access is based on organization membership and the product entitlement. Each product then applies its own free or paid tier and local workspace roles. Service-to-service access uses short-lived, audience- and purpose-bound credentials; possession of a central account alone is not permission to change product data.
Product boundaries
The products exchange only the context and outcomes a workflow needs. Business records are not copied into Autokore or Protheos as competing sources of truth, and execution state is not copied into Protheos as a second automation system.
Operations and environments
Development and production are isolated by environment-specific identities, data, secrets, queues, keys, logs, backups, and access rules within one AWS account. Public endpoints use encrypted transport. Protected service data uses the encryption controls provided by the owning AWS services.
This page describes the implemented security approach; it is not a claim of a third-party certification, compliance audit, uptime guarantee, or formal service-level agreement.
Report a security concern
Send a concise description, the affected product or URL, reproduction steps, and potential impact to engineering@zelikore.com. Do not include passwords, access tokens, private keys, or customer data in the first message.