Security & Audit Center
The Pocket Kit Security & Audit Center provides continuous compliance monitoring, automated posture evaluations, and real-time security telemetry across your entire infrastructure.
Real-Time Posture Scoring
The Security Center continuously calculates an overall security posture score (0–100%) based on five pillars:
- Two-Factor Authentication (2FA) Adoption (30 pts): Evaluates whether TOTP or WebAuthn passkeys are active on admin accounts.
- Production Deletion Protection (25 pts): Ensures mission-critical production instances have accidental termination prevention turned on.
- Automated S3/R2 Backup Storage (20 pts): Confirms that cloud backup synchronization is configured for daily snapshots.
- Recent Threat Monitoring (15 pts): Checks for unusual spikes in failed login attempts or unauthorized access probes over the last 24 hours.
- BYOK Secret Vault Encryption (10 pts): Verifies that AI API keys and tenant environment variables are encrypted with dedicated cipher keys.
Actionable Recommendations Matrix
When posture checks detect risks (such as an unprotected production instance or missing offsite backup replication), the Security Center displays step-by-step remediation buttons:
- “Enable 2FA Now” → Direct link to multi-factor setup.
- “Enable Protection” → 1-click lock on production instances.
- “Configure S3 Sync” → Setup automated S3/R2 database replication.
Audit Event Stream
The Security Center maintains a comprehensive tamper-resistant audit trail of platform events:
| Event Type | Severity | Description |
|---|---|---|
auth_success | INFO | Successful console sign-in |
auth_failed | WARN | Invalid credentials or identity probe |
mfa_enabled | INFO | User activated Google Authenticator or Passkey |
mfa_disabled | WARN | User turned off two-factor authentication |
mfa_recovery_used | WARN | Emergency backup code used for sign-in |
env_updated | INFO | Environment vault keys modified |
policy_override_created | INFO | Cedar authorization policy override applied |
instance_created | INFO | New PocketBase tenant provisioned |
instance_deleted | WARN | PocketBase tenant decommissioned |
You can search and filter the audit log by severity (INFO, WARN, CRITICAL), event category, or IP address in real time.