Security at Wildwood

Wildwood is built as a multi-tenant backend platform, so security and data isolation are core to the product—not an afterthought. Here is how we protect your data and your users.

Encryption Everywhere

All traffic is served over HTTPS with HSTS enforced. Sensitive fields—API keys, OAuth client secrets, payment provider secrets, and TOTP secrets—are encrypted at rest using the ASP.NET Core Data Protection API, with keys that travel securely with your database.

Modern Authentication

JWT-based authentication with automatic, short-lived token refresh. Support for passwordless passkeys (FIDO2/WebAuthn), two-factor authentication (TOTP), trusted devices, and social sign-in providers—so you can offer phishing-resistant login out of the box.

Strict Multi-Tenant Isolation

Every record is scoped by application and company. Global query filters enforce tenant boundaries at the data-access layer, so one app can never read another app's data—a guarantee that is enforced in code, not just by convention.

OAuth 2.1 for AI Agents

The Model Context Protocol (MCP) server uses OAuth 2.1 with PKCE. AI-agent access is role-restricted, every tool call is audit-logged, and configuration-changing operations require explicit confirmation and automatic snapshots for rollback.

Abuse & Bot Protection

Configurable rate limiting on authentication endpoints, password policies with optional expiry, and CAPTCHA support (reCAPTCHA and hCaptcha) protect your users against credential-stuffing and automated abuse.

Auditability & Recovery

Administrative and AI-agent actions are logged for traceability, and configuration changes are snapshotted automatically so they can be restored if something goes wrong.

Have a security question or want to report a vulnerability?

Contact our security team