Built for the team that has to sign off.
mTLS between every internal hop. AES-256-GCM on every secret. A tamper-evident audit log enforced by the database. Your CISO will recognize every control.
Security controls, by design.
Encryption everywhere, every direction.
TLS 1.3 on every inbound and outbound hop, mutual auth available throughout. AES-256-GCM for secrets at rest.
Your keys. Your KMS. Your control.
BYOK against AWS, GCP, Azure, Vault, or HSM. Per-tenant keys wrapped with a customer-controlled master. Instant revocation.
Tamper-evident, enforced at the database.
Each entry hashes the previous one, so any retroactive edit breaks the chain. Append-only triggers reject updates and deletes.
Authenticate inbound with anything.
JWT, OAuth2, API key, mTLS, SigV4, and custom schemes, mixable per route. Outbound auth is an independent choice.
PII never leaves the gateway un-masked.
JSONPath and regex redaction on responses. The audit log records the path of a redacted field, never the value.
Secrets are fetched, not stored.
Upstream credentials pulled from your secret store at request time, cached in encrypted memory briefly, never written to disk.
Encrypted at every hop. Including yours.
From the caller's keyboard to the upstream's response, no byte is in plaintext on any wire we control. The encryption envelope below is enforced by the gateway, it is not a marketing claim.
If it touches the wire,
it's on the chain.
Six things we lose sleep over,
and what we did about them.
Insider edits the audit log.
A privileged operator changes a historical request entry to erase evidence of an unauthorized action.
SHA-256 chain + DB-level append-only.
Edits break the chain. Triggers reject the write. Continuous off-site verification.
Misconfigured route exposes PII.
A transform omits a redaction rule and customer SSNs leak to a downstream system.
Mandatory redaction policy at the tenant level.
Tenant policies can require redaction for declared PII paths, routes that omit them fail validation.
Caller impersonates another tenant.
An attacker presents a JWT for a different tenant to access routes they shouldn't.
Tenant binding at route resolution.
JWT tid claim is matched against the route's tenant. Mismatch returns 403 before transform even begins.
Upstream is slow; gateway exhausts.
A backend slows; the gateway accumulates pending requests until the pool dies.
Hedged requests + circuit breakers per upstream.
Pool isolation prevents one bad upstream from starving others. Adaptive load shedding kicks in before exhaustion.
Script execution escapes its sandbox.
A transformation script tries to read the filesystem or open a network socket.
Sandboxed VM, no syscalls, CPU-bounded.
Lua and JS run in deny-by-default sandboxes. No filesystem, no net, no env. CPU and memory bounded per invocation.
Tampered binary in distribution.
A binary or container image is modified between Rallyum's build and customer install.
Sigstore-signed builds, in-toto attestation.
Customers verify signatures and attestations before install. Air-gap bundles ship with offline-verifiable provenance.
Ready for your security team.
Architecture overview, data-flow diagrams, and a security questionnaire walkthrough, available on request. Talk to us about what your review needs.