Sovereign Security Architecture

Enterprise Security & Cryptography

Project Pak-LLM is built upon a defense-in-depth security model combining Post-Quantum Cryptography, cryptographically sealed API gateways, HMAC webhook verification, and automated PII redaction.

SHA-256 Sealed

Cryptographic API Gateway

All API keys generated via the Admin Dashboard are hashed immediately using one-way SHA-256 with salted tenant identifiers. Raw keys are never stored in plaintext and cannot be recovered if lost.

  • Granular RBAC scopes (chat:completions, embeddings, models:read, admin:all)
  • Sliding-window token bucket rate limiting (10 to 600 RPM)
  • Optional client IP address allow-listing and auto-expiry schedules
  • Instant zero-downtime key revocation from the Admin Console
Signed Delivery

HMAC-SHA256 Webhook Dispatcher

Every outbound event dispatch (chat completions, workflow approvals, courier dispatches) is cryptographically signed with a tenant-unique secret using HMAC-SHA256.

  • Standard signature header: x-pakllm-signature-256 (sha256=...)
  • Replay attack prevention with strict unix timestamp validation
  • Automated exponential backoff retries with delivery status audit logs
  • Payload integrity verification compatible with standard enterprise receivers
NIST FIPS 203/204

Post-Quantum Cryptography (PQC)

Engineered to withstand Harvest Now, Decrypt Later quantum threats. Pak-LLM integrates lattice-based ML-KEM-768 key encapsulation and ML-DSA digital signatures.

  • Quantum-resistant envelope encryption for Sovereign Vault secrets
  • ML-DSA signed immutable workflow execution audit receipts
  • Hybrid post-quantum TLS session negotiation for domestic transport
  • AES-256-GCM authenticated symmetric encryption at rest
Deterministic Filter

Amanah Gate PII & Shariah Redaction

Built-in domestic interceptor scanning inbound prompts and outbound completions in real time to scrub sensitive citizen information before it ever reaches volatile memory.

  • Automated Pakistani CNIC format redaction (XXXXX-XXXXXXX-X)
  • Domestic banking IBAN and account number sanitization
  • Proactive blocking of usurious (Riba) and deceptive (Gharar) financial schemes
  • Zero prompt storage — prompts execute in RAM and are discarded post-stream
Webhook Signature Verification Pattern
RFC 2104 HMAC-SHA256

When Pak-LLM dispatches an event to your webhook URL, inspect the x-pakllm-signature-256 header and verify using your webhook secret:

import crypto from "crypto";

export function verifyPakLlmSignature(payloadRawBody: string, signatureHeader: string, secret: string): boolean {
  const expectedSignature = `sha256=${crypto.createHmac("sha256", secret).update(payloadRawBody).digest("hex")}`;
  return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expectedSignature));
}

Vulnerability Disclosure & Hall of Fame

We welcome independent security researchers to audit our public endpoints and reporting mechanisms under our coordinated vulnerability disclosure program.

Hall of Famesecurity.txt