Plaintext command bodies don't reach our infrastructure.

Protocol v2 uses AES-256-GCM with a per-message key wrapped to the device and authenticates every behavior-driving envelope field. New commercial tenants use v2; the legacy pilot wire format remains a migration boundary.

ECDSA P-256 SHA-256 for device signing keys and ACKs today; Ed25519 is also accepted but no shipped client generates it. Devices sign ACKs and the gateway verifies the signature and replay state before recording them.

LockiaMQ forwards ciphertext only; the gateway authn/authz hooks see metadata; the database has no plaintext column.

Each message's data key is wrapped to the target device's registered RSA-OAEP public key, so only that device can unwrap it. KMS/HSM-backed custody for wrap keys is designed behind a provider trait but not yet shipped.

Tenant sender public keys register, rotate, and revoke through a tenant-scoped, idempotent workflow. Private keys remain customer-managed, retired public keys remain available for historical verification, and each change is audit-logged.

ACK replay windows and connect nonces are persisted across replicas, with durable SDK ACK retry and duplicate suppression. Production failover evidence remains a rollout gate.

Gateway and orchestrator enforce issuer, audience, expiry, subject membership, and registered machine-client scopes on each authenticated request.

Core mutations and denials emit audit events. Retention and data-rights workflows are implemented but operator-disabled until policy and legal approval; no certification is claimed.