statioProduct
Use Cases
Resources
Security at Statio
Security is not a feature we added — it is the product. Every design decision starts with the assumption that agents, credentials, and customer data must be isolated, encrypted, and auditable.
Credential encryption
All API keys stored in Statio are encrypted at rest with AES-256. Keys are decrypted only at call time within the gateway process and never cached or logged in plaintext. At no point does an agent see the raw credential — Statio injects it on the agent's behalf.Token expiry
STATIO_TOKENs expire after 24 hours and auto-refresh through the SDK. If a token is compromised, it's useless within a day. Revocation is immediate — kill a token from the dashboard and all in-flight requests with that token are rejected.Access policies
Granular RBAC per agent. Define which agents can access which APIs, for which customers, with which permissions. Policies are evaluated at the gateway before any credential is decrypted. Deny by default — agents only reach APIs they've been explicitly granted access to.Audit trails
Every API call through Statio is logged with full context: agent identity, customer context, timestamp, target endpoint, request parameters, and response status. Logs are immutable and append-only. Exportable for compliance reviews, incident response, and forensics.Multi-tenancy
Each customer's credentials are fully isolated. Tenant boundaries are enforced at the gateway layer — there is no code path where one tenant's request can access another tenant's credentials. Isolation is architectural, not just logical.Network security
All traffic to and from Statio is encrypted with TLS 1.3. The gateway runs on GCP Cloud Run with automatic scaling, built-in DDoS protection, and no persistent server state. Requests are processed in ephemeral containers that are destroyed after execution.Vulnerability scanning
Every MCP server in the Statio catalog is scanned for known vulnerabilities using Grype before deployment. Servers with critical or high-severity CVEs are blocked from production. Scans run on every build — not just at initial publish.Static analysis
Semgrep runs custom security rules against every MCP server before deployment. Detects sensitive environment variable reads, outbound calls to non-allowlisted domains, dynamic code execution (eval, Function, child_process), and data exfiltration patterns like Base64-encoded env vars.Network egress controls
MCP servers run on Cloud Run with VPC egress restrictions. All outbound traffic routes through a VPC with firewall rules and Cloud NAT. Servers cannot reach arbitrary domains — only allowlisted API endpoints are reachable.Binary authorization
Container images must be signed by our build pipeline before Cloud Run will execute them. No unsigned or tampered images reach production. Enforced at the GCP infrastructure level, not the application level.Compliance
SOC2 Type I assessment is in progress. Full audit logs are exportable in standard formats for compliance reviews. Statio's architecture — encrypted credentials, immutable audit trails, RBAC, tenant isolation — is designed from day one to meet enterprise compliance requirements.Responsible disclosure
If you discover a security vulnerability, please report it to [email protected]. We take every report seriously and will respond within 48 hours. We do not pursue legal action against good-faith security researchers.Ready to connect your team?Free to start. No card required.Start free
statioProductFeaturesPricingGetting StartedSecurityChangelogmcp-gen
LegalPrivacy PolicyTerms of Service
© 2026 Statio. A product of SID Technologies.