API Security Built for SaaS Platforms
Your API is your product. G8KEPR protects it with multi-tenant isolation, append-only audit log, API key lifecycle management, and pre-mapped controls across 12 compliance frameworks (+8 reference catalogs).
Understanding the unique challenges of securing a multi-tenant API platform
SaaS APIs serve many customers simultaneously. Each tenant expects strict isolation, reliability, and security. Every API endpoint is a potential attack surface — and a revenue stream.
Authorization: Bearer sk_live_...X-Tenant-ID: acme_corpX-RateLimit-Remaining: 4,521POST /webhooks/eventsSaaS APIs face unique security challenges. Customer data must be isolated, usage tracked for billing, and compliance evidence must be tamper-evident and exportable.
Enterprise-grade security for every API request, every tenant, every time
POST /api/v2/users -H "Authorization: Bearer sk_live_acme..."✓ Complete tenant isolation • Usage tracked for billing • Compliance-ready logs
Enforce strict boundaries between customers. Prevent cross-tenant data access, scope API keys to specific tenants, and protect against noisy neighbors.
Full key management: creation, rotation, revocation, and expiry. Detect leaked keys, enforce scopes, and support multiple keys per customer.
Security events and admin actions are recorded against each organization and shown in the dashboard audit view, so every tenant has its own history.
How G8KEPR protects your platform and customers
Attacker: GET /api/data -H "Authorization: Bearer sk_live_..."GET /api/users?tenant_id=competitor_corpPOST /api/v2/process (10,000 requests from 50 "free" accounts)GET /api/schema/* (exhaustive endpoint enumeration)Zero code changes to your tenant APIs or AI agent stack. Target: Sub-5ms gateway proxy overhead on cached, single-region paths.
Not in Anthropic's MCP spec. Not in API gateways. Not in WAFs. Platform-level additions built for multi-tenant SaaS workloads.
MCP servers the proxy launches locally (stdio, off unless the operator sets MCP_STDIO_SERVERS_ENABLED) run in their own session (setsid), drop to nobody if started as root, and get no-new-privs, ambient capabilities cleared and RLIMIT_AS/FSIZE/NOFILE/NPROC ceilings. Remote (HTTP) servers are proxied and inspected, not sandboxed, and network egress is not filtered.
SHA-256 hash of every tenant tool definition pinned at tools/list. On every tools/call, the cached definition is re-hashed and compared. Drift raises MCPRugPullDetectedError, blocks execution, publishes a CRITICAL event.
Statistical, not threshold-based. Z-score > 3.0 against per-hour time-of-day baselines. 4 overlapping sliding windows (1m/5m/15m/1h). Progressive recovery (10→25→50→100%).
Findings from all four pillars land on one threat-event bus. A compound correlator groups them in 5-minute windows by correlation ID and by organization + client IP, and raises one incident when they match a known multi-stage pattern: a prompt injection at the gateway plus an SSRF probe and a path traversal at the API from the same client become a single critical Lethal Trifecta finding.
HMAC-SHA256 hash chain on authentication and domain events (since 2026-09-13), each entry signing the previous. Three verification levels (full / single / last-N). Control mapping (not an attestation) for SOC 2 CC7.2 audit observation and customer compliance attestations.
Cross-session attack detection: 6-dimension risk score (max 110) across tool sensitivity, data volume, burst, denials, prior detections, and tool diversity. Catches cross-tenant escalation attempts and 24h slow-and-low patterns.
Every pillar publishes its findings to one threat event bus. The compound correlator joins findings on the same request by correlation ID, and separate requests from one client by organization + client IP.
mcp_tool_calls with its correlation ID • Compound findings link every contributing finding • Hash-chain entries are tamper-evident for SOC 2 audit observationEverything you need to secure and scale your API platform
Docker deployment or SDK integration. No infrastructure changes required. Start protecting your API in minutes, not weeks.
npm install g8keprPre-mapped controls across 12 frameworks with assessment engines (SOC 2, GDPR, HIPAA, ISO 27001), plus 8 reference control catalogs. A control crosswalk maps each SOC 2 control to its overlapping ISO 27001 and HIPAA controls.
Append-only audit logEnforce tenant boundaries at the API layer. Prevent cross-tenant access, scope keys to tenants, and protect against data leakage.
Per-tenant scoping enforcedFull lifecycle: create, rotate, revoke, expire. Detect leaked keys, enforce scopes, and support multiple keys per customer.
Zero-downtime rotationSecurity events and admin actions are recorded against each organization, and each tenant’s history is shown in the dashboard.
Scoped by organizationSDKs for every language. OpenAPI integration. Detailed error messages. Built by developers, for developers.
Python, Node, Go SDKsIntegrate with the tools and platforms you already use
Common questions about securing your SaaS API platform
Need help securing your SaaS platform?
Talk to our SaaS security experts →Every API request written to the append-only audit log. Control crosswalk — each SOC 2 control is mapped to its overlapping ISO 27001 and HIPAA controls.
"-Ready" / "aligned" reflect capability posture. SOC 2 Type II observation in progress with external audit engagement H2 2026.
Multi-tenant isolation, usage billing, and append-only audit. Built for scale.
No credit card required • Free tier available • Full feature access