Security that fights back.
Most systems just lock the door. SIMEZU also wastes an attacker's time and records every move in a log you can verify end to end.
Make intrusion expensive.
Honeypots and canaries
Trap endpoints and canary tokens that only an intruder would ever touch.
Progressive tarpit
Suspicious clients slow down tier by tier: jitter, then delay, then a block.
Anomaly detection
Probe patterns, swarms and permission velocity, flagged in real time.
MFA and lockout
TOTP, rate limits and account lockout protect every sign-in path.
You decide who gets in, and who never does.
Allowlist trusted users and IPs, blocklist bad actors, and enforce policy per environment. A ban cascades across every connected app and group, so it sticks everywhere at once.
Allowlisting
Restrict an environment to named users, teams or verified email domains.
Blocklisting
Block users and IPs outright; every sign-in attempt is refused immediately.
Ban cascade
A ban propagates to every connected app, app-group and platform group at once.
Per-environment policy
Forced login, access restriction and SSO scope, set independently per surface.
Every door is locked, watched and rate-limited.
MFA (TOTP)
Authenticator-app two-factor, enforceable for admin and high-risk roles.
Rate limiting
Per-IP and per-account throttling stops credential stuffing at the edge.
Account lockout
Repeated failures lock the account and notify the owner by email.
RS256 + JWKS
Asymmetric token signing with rotating public keys you verify locally.
An audit log you can prove.
Every action is HMAC-chained to the one before it. Change a single record and the chain breaks, so you always know the log is intact.
# each entry signed with the previous hash login.success user=4f9a prev=0a3c… token.issue actor=user prev=8b21… scope.grant app=simuze prev=c47e… chain verified ✓ 0 breaks
Built to be trusted.
European infrastructure. GDPR by design. Your data stays yours.
Security you can call directly.
Token verification, MFA policy, the audit chain and agent scopes are all part of the API. Nothing is a black box.
// Verify a SIMEZU access token against the rotating JWKS import { createRemoteJWKSet, jwtVerify } from 'jose'; const JWKS = createRemoteJWKSet(new URL('https://simezu.com/oauth/jwks.json')); const { payload } = await jwtVerify(token, JWKS, { issuer: 'simezu', audience: '<your application id>', }); // payload.sub is the entity id — a user or an agent if (payload.actor_type === 'agent' && !payload.roles.includes('admin')) { throw new Error('insufficient scope'); }
Tokens are RS256-signed. Fetch the rotating JWKS once, then verify locally — no round trip per request.
# Enrol a second factor — returns an otpauth:// URI to render as a QR curl -X POST https://simezu.com/api/auth/mfa/enroll \ -H "Authorization: Bearer $ACCESS_TOKEN" # A login that needs a second factor answers with a challenge { "status": "mfa_required", "mfa_token": "…" } # Exchange the challenge for a real session curl -X POST https://simezu.com/api/auth/mfa/challenge \ -d mfa_token=$MFA_TOKEN -d code=123456
TOTP enrolment and challenge are ordinary endpoints. SIMEZU tracks the factor; your app reads the result.
# Walk the HMAC-chained audit log and prove nothing was altered curl https://simezu.com/api/auth/admin/audit-logs/verify \ -H "Authorization: Bearer $SIMEZU_ADMIN_TOKEN" { "chain": "intact", "entries": 1284, "broken_at": null } # A canary token is touched: the tarpit engages and it is recorded { "event": "canary.triggered", "actor_type": "agent", "action": "blocked", "tarpit_tier": 3 }
Every entry is HMAC-chained to the one before it, so an altered or deleted row breaks the chain and says where.
# Agents are entities, ranked alongside users and groups curl -X POST https://simezu.com/api/auth/agents \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -d name=booking-concierge \ -d 'scopes[]=bookings:read' -d 'scopes[]=calendar:read' { "token": "sk_agent_3f9a…b21e" } # The token is shown once. Revoke this agent alone, leaving every # other identity untouched. curl -X POST https://simezu.com/api/auth/agents/$AGENT_ID/revoke \ -H "Authorization: Bearer $ACCESS_TOKEN"
An agent is a first-class identity with its own token and scopes — never a shared API key. Revoke it on its own.