Architecture synopsis for security leaders

What replaces static credentials?

Credentials that expire in minutes, only work from the device that earned them, and can only do the one job they were minted for.

That is how MnemoShare moves files without a standing SSH key, service account, or shared login anywhere in the path.

Get the CISO white paper Try it free for 7 days

The short answer

Ephemeral, device-bound, scoped

A static credential is dangerous on three axes at once: it lasts, it travels, and it can do anything. MnemoShare removes all three.

Short-lived by default

Nothing standing to steal.

Access tokens live 60 minutes by default, 15 minutes on hardware mTLS sessions, and rotate on every refresh.
Replay a refresh token that has already been rotated and the whole token family is revoked, not just that one.
Hardware certificates default to 30 days, are capped at 90, and renew with a single command.

Bound to the client

Lifted off one machine, useless on another.

Private keys are generated inside a YubiKey, Secure Enclave, or TPM and never exported. On Apple silicon each signature needs a live biometric.
The server ties the session to the certificate that opened it and re-checks that certificate’s live status on every request.
A newly enrolled key stays pending until it is approved: the user confirms it themselves after signing in to the portal with TOTP or WebAuthn, or an admin does. Refresh tokens carry the device identity, so revoking the device cascades.

Scoped and limited

A session does exactly one job.

Mint a CLI session for specific actions (upload, download, list, sync) and specific folders. A refresh can never widen that scope.
Client CLI tokens carry allowed paths, allowed operations, and an expiry, with refresh bound to the client IP and user agent. API keys carry a permission list and an expiry.
Share links can be one-time-use, password-protected, question-gated, expiring, and revoked on demand.

Lifetimes above are shipping defaults. Every one of them is configurable per deployment, and refresh-token binding to client IP and user agent is on by default.

How a request flows

Identity in, evidence out

Five steps between a person or process and a file. None of them rely on a secret that was created last year.

step_01

Prove identity

SSO through your IdP, or a hardware key whose private key never leaves the device.

standing secretnone

step_02

Mint a scoped token

Short-lived access token plus a rotating refresh token, limited to the actions and folders requested.

access ttl15–60 min

step_03

Re-validate every call

Revocation list, certificate status, idle timeout, and scope are checked per request, not per token lifetime.

revocation lag1 request

step_04

Rotate or expire

Refresh rotates the token family; reuse of a rotated token kills the family. Idle sessions time out.

refresh reusefamily revoked

step_05

Record it

Issuance, refresh, use, and revocation land in the tamper-evident audit chain with secrets hashed or omitted.

evidenceexportable

What it looks like from the CLI

A scoped session is the default posture, not an advanced option. Ask for the actions and folders a job needs; the token cannot do anything else, and a refresh cannot add to it.

Hardware enrollment puts the private key in a YubiKey, Secure Enclave, or TPM. Renewal is one command. Revocation takes effect on the next request.

mnemocli — scoped, hardware-bound session

$mnemocli login --scope upload,list --folder fld_7Qk2 --label nightly-export

↳session minted · scopes=[upload list] · folders=[fld_7Qk2] · access expires in 60m

$mnemocli hardware enroll --provider secure-enclave --validity 30d

↳key generated in hardware (non-exportable) · cert pending approval (portal: TOTP/WebAuthn)

$mnemocli session list

↳ses_3f1a nightly-export hardware-9c41… last used 4m ago

$mnemocli session revoke ses_3f1a

↳family revoked · access token blacklisted · effective immediately

Side by side

The SSH key on the vendor’s box, versus this

	Static credential	MnemoShare
Lifetime	Years. Rotated when someone remembers.	Minutes to hours. Rotates itself.
Where it lives	A file on disk. Copyable, emailable, committed by accident.	Non-exportable key in hardware, or a token tied to that key.
What it can reach	The whole server, every directory, read and write.	Named actions on named folders. Refresh cannot widen it.
Revoking it	Find every copy. Rotate every consumer. Hope.	One request. Enforced on the next call.
Proving what happened	Grep the SFTP log and reconstruct by hand.	Tamper-evident chain of who, what, when, from which device.

CISO white paper

The full security architecture, written for your review

The MnemoShare Security Architecture white paper (v2.0): the threat model, the identity and credential design behind this page, and the encryption, audit, and enforcement layers around it. Written to be handed to an architect or an auditor as-is.

The real threat model: stolen credentials, insiders, and the third-party path
Identity and authentication model: SSO, hardware-bound mTLS, scoped short-lived sessions
Encryption and key ownership, including customer-held keys
Audit evidence and immutability: what is recorded and how it is proven
Regulated mode, DLP and content intelligence, behavioral anomaly detection
Deployment options and the shared responsibility model

Company email only. We confirm the address before sending, and we never share the list.

See it against your own threat model

Two ways in. Pick the one that fits how your team evaluates.

Provision a tenant, free for 7 days

Your own subdomain, live in minutes, no sales call. Enroll a hardware key, mint a scoped session, pull the audit export, and decide for yourself.

Start the 7-day trial

Schedule a demo

A walkthrough mapped to how your organization moves sensitive data today, with the people who built the credential model in the room.

Book a time

Go deeper