---
export const prerender = true
import Layout from '../layouts/Layout.astro'
import { LandingHero } from '../components/cro/LandingHero'
import { HowItWorks } from '../components/cro/HowItWorks'
import { LandingFeatures } from '../components/cro/LandingFeatures'
import { ProofBar } from '../components/cro/ProofBar'
import { Testimonials } from '../components/cro/Testimonials'
import { ComparisonTable } from '../components/cro/ComparisonTable'
import { PricingSection } from '../components/cro/PricingSection'
import { FAQSection } from '../components/cro/FAQSection'
import { SecondaryCTA } from '../components/cro/SecondaryCTA'
import { Lock, Shield, Key, Eye, FileText, Server } from 'lucide-react'

const features = [
  {
    headline: 'No password. No seed phrase. Touch ID.',
    body: 'Keys live in the Apple Secure Enclave — a dedicated processor Apple\'s own engineers cannot read. Touch ID is non-transferable by physics, not by policy. There is no password to phish. No credential to steal from a server. Nothing stored server-side.',
    icon: Lock,
    tone: 'primary' as const,
  },
  {
    headline: '5 wallet states — security grows with value',
    body: 'State 1: ephemeral (zero friction, spending cap). State 2: saved (Touch ID gated, BIP39 paper break-glass). State 3: linked to Google account. State 4: multi-device via iCloud/Google Password Manager. State 5: recovered from 12-word paper. Security grows as the user commits.',
    icon: Shield,
    tone: 'tertiary' as const,
  },
  {
    headline: 'GDPR erasure in one command',
    body: 'persist.forget(uid) deletes the actor and cascades to memberships, capabilities, paths, and signals. Schema handles referential integrity. Audit signal emitted automatically. Article 17 compliance in one TypeQL statement. No cleanup script.',
    icon: Key,
    tone: 'secondary' as const,
  },
  {
    headline: 'Per-tenant data isolation',
    body: 'Each client workspace is a separate TypeDB tenant. A deletion request for one client touches nothing else. Tenant key encryption key (KEK) deletion makes data unreadable instantly — no row-by-row deletion across tables.',
    icon: Eye,
    tone: 'primary' as const,
  },
  {
    headline: 'EU AI Act — co-sign makes covert action structurally impossible',
    body: 'The co-sign pattern requires a human Touch ID to complete any transaction above a threshold. The scoped autonomy pattern runs agent transactions through a Move module that enforces daily caps at consensus level. "Cannot" is different from "should not."',
    icon: FileText,
    tone: 'tertiary' as const,
  },
  {
    headline: '8-step policy enforcement before every signal',
    body: 'ABAC, RBAC, ReBAC, capability, budget, rate limit, nonce deduplication, delivery — in that order. No signal reaches an agent without clearing all eight. No silent failures. Every closed signal closes its loop with mark, warn, or dissolve.',
    icon: Server,
    tone: 'secondary' as const,
  },
]

const steps = [
  { label: 'Touch ID fires', description: 'The user taps Touch ID. The Secure Enclave PRF derives a key. AES-256-GCM unwraps the Ed25519 seed. The seed exists in memory for the duration of one sign operation — milliseconds.', detail: 'Touch ID → SE PRF → AES-256-GCM unwrap → Ed25519 seed (milliseconds)' },
  { label: 'The seed is used and erased', description: 'WebCrypto imports the seed as non-extractable. The transaction is signed. The raw bytes are zeroed immediately. The seed is never logged. Never sent over the network. Never stored on ONE\'s servers.', detail: 'crypto.subtle.importKey(extractable: false) · seed.fill(0) · tx lands on-chain' },
  { label: 'The transaction lands on-chain', description: 'The signed transaction goes to the blockchain. The memory is clear. The only record is on-chain. From Touch ID to confirmation in under 5 seconds.', detail: 'Sui tx · <5 seconds p50 · on-chain record only' },
  { label: 'Quarterly canary verification', description: 'Every quarter, a canary transaction fires on each active deployment. The result either verifies or it doesn\'t. A failed canary triggers immediate investigation. Verification over presence. Deterministic check, not a compliance ritual.', detail: 'quarterly canary tx · deterministic check · immediate investigation on fail' },
]

const testimonials = [
  {
    quote: 'Our GDPR review used to take a week. Now I can produce a complete data export for any individual in one API call and fully erase them in one command. That\'s what the dental client shows their own regulator.',
    name: 'Marcus J.',
    role: 'Director',
    company: 'Northgate Marketing, Manchester',
  },
  {
    quote: 'No passwords to reset. No seed phrases to store. My patients tap Touch ID and the payment goes through. The compliance story for the practice went from "we\'re working on it" to "here\'s the architecture."',
    name: 'Sarah O\'Callaghan',
    role: 'Practice Manager',
    company: 'North Dublin Dental',
  },
  {
    quote: 'Eight steps before a signal reaches an agent. ABAC, RBAC, ReBAC, capability check, budget, rate limit, nonce deduplication, delivery. My security team read the architecture and stopped asking questions.',
    name: 'Brad S.',
    role: 'Founder',
    company: 'PT Corp',
  },
]

const comparisonRows = [
  { feature: 'Keys in Secure Enclave — never on server', us: 'yes', alt1: 'no', alt2: 'no' as const },
  { feature: 'No passwords anywhere in the flow', us: 'yes', alt1: 'no', alt2: 'no' as const },
  { feature: 'GDPR erasure in one command (Article 17)', us: 'yes', alt1: 'partial', alt2: 'no' as const },
  { feature: 'Per-tenant KEK isolation', us: 'yes', alt1: 'partial', alt2: 'no' as const },
  { feature: '8-step policy enforcement before every signal', us: 'yes', alt1: 'no', alt2: 'no' as const },
  { feature: 'Quarterly canary verification (deterministic)', us: 'yes', alt1: 'no', alt2: 'partial' },
  { feature: 'Physical infrastructure control (your servers)', us: 'partial', alt1: 'partial', alt2: 'yes', note: 'Honesty: self-hosted infrastructure on your own servers wins on physical control. ONE outsources that to Cloudflare and TypeDB Cloud.' },
]

const tiers = [
  {
    name: 'Starter',
    monthlyPrice: '$625',
    annualPrice: '$500',
    description: 'Passkey auth · basic GDPR tools',
    features: ['5M credits/mo', 'Passkey (Secure Enclave) authentication', 'Basic GDPR deletion tooling', 'Per-tenant data isolation', 'Email support'],
    cta: 'Start securely',
    ctaHref: '/get-yours',
  },
  {
    name: 'Agency',
    monthlyPrice: '$6,250',
    annualPrice: '$5,000',
    description: 'Full compliance · co-sign pattern',
    features: ['60M credits/mo', 'Full 5-wallet-state lifecycle', 'Co-sign + scoped autonomy patterns', 'persist.reveal() + forget() GDPR tools', '8-step policy enforcement', 'Quarterly canary verification'],
    cta: 'Start my secure agency',
    ctaHref: '/get-yours',
    popular: true,
  },
  {
    name: 'Scale',
    monthlyPrice: '$62,500',
    annualPrice: '$50,000',
    description: 'SOC 2 · dedicated infrastructure',
    features: ['750M credits/mo', 'SOC 2 report access', 'Dedicated Cloudflare edge region', 'Custom data residency', 'Dedicated success manager', 'SLA 99.99%'],
    cta: 'Talk to us',
    ctaHref: '/get-yours',
    enterprise: true,
  },
]

const faqs = [
  { q: 'Where are the keys stored?', a: 'In the Apple Secure Enclave — a dedicated security processor, physically separate from the application CPU. Apple\'s own engineers cannot read the keys. ONE cannot read the keys. The gate is Touch ID: a biometric that is non-transferable by physics, not by policy.' },
  { q: 'What happens if a user loses their device?', a: 'State 2 onwards includes 12 BIP39 words written on paper at setup time. On loss of device, the user uses the 12 words to restore. Multi-device (State 4) syncs the passkey to iCloud or Google Password Manager as a second enrolled device.' },
  { q: 'How does GDPR Article 17 (erasure) work?', a: 'persist.forget(uid) deletes the actor and cascades to memberships, capabilities, paths, and signals. The TypeDB schema handles referential integrity — no cleanup script needed. An audit signal is emitted automatically. One command. Complete erasure.' },
  { q: 'How does GDPR Article 20 (data portability) work?', a: 'persist.reveal(uid) returns a complete memory card: all hypotheses with confidence and source, top paths, full signal history, channel memberships, capabilities, and unexplored tag clusters. One API call. Human-readable, structured, auditable.' },
  { q: 'Is the data isolated between clients?', a: 'Yes. Each client workspace is a separate TypeDB tenant. Queries cannot cross tenant boundaries. A deletion request for one client touches nothing else. KEK deletion makes the data unreadable instantly.' },
  { q: 'What is the threat model for phishing?', a: 'Passkeys are domain-bound. The credential only works on the domain it was registered for. No password exists to phish. Touch ID is the only gate. The accepted risk is a user approving a legitimate-looking but malicious transaction at the UI layer.' },
  { q: 'What compliance frameworks does the architecture support?', a: 'GDPR: per-tenant isolation, one-command erasure (Article 17), one-call portability (Article 20). SOC 2: availability via Cloudflare edge, confidentiality via per-tenant KEK, security via 8-step PEP, processing integrity via 4-outcome loop. EU AI Act: co-sign and scoped autonomy patterns for high-risk actions.' },
  { q: 'What is the 8-step policy enforcement point?', a: 'ABAC (attribute-based), RBAC (role-based), ReBAC (relationship-based), capability check, budget check, rate limit, nonce deduplication, delivery. All eight run before any signal reaches an agent. No signal passes without clearing all eight.' },
]
---

<Layout
  title="Security — No Passwords, Secure Enclave, GDPR in One Command | ONE"
  description="Keys in the Apple Secure Enclave. Touch ID as the only gate. No seed phrases on our servers. GDPR erasure in one command. 8-step policy enforcement before every signal."
  sidebar="none"
  chat="none"
>
  <main>
    <LandingHero
      client:idle
      eyebrow="Security architecture"
      headline="No passwords. No seed phrases."
      highlight="Secure Enclave and Touch ID."
      subhead="When there is nothing to store, compliance gets smaller. When there is nothing to leak, breach disclosure gets shorter. The security story is two sentences."
      primaryCta={{ label: 'Read the architecture', href: '#features' }}
      secondaryCta={{ label: 'See the threat model', href: '#comparison' }}
      frictionText="No passwords anywhere · GDPR Article 17 in one command · 14-day free trial"
      visual="Sign flow: Touch ID → SE PRF → AES-256-GCM unwrap → Ed25519 seed (milliseconds) → sign(txBytes) → seed.fill(0) → tx on-chain. Seed never leaves device."
    />

    <ProofBar
      client:idle
      stats={[
        { label: 'Time for Touch ID to signed transaction on-chain', value: '<5s' },
        { label: 'GDPR Article 17 erasure — one command', value: '1 cmd' },
        { label: 'Policy enforcement steps before every signal', value: '8' },
        { label: 'Passwords anywhere in the flow', value: '0' },
      ]}
      leadQuote={{
        quote: 'When there is nothing to store, compliance gets smaller. When there is nothing to leak, breach disclosure gets shorter.',
        name: 'Anthony O\'Connell',
        role: 'Founder',
        company: 'ONE',
      }}
    />

    <HowItWorks
      title="From Touch ID to on-chain — under 5 seconds"
      subtitle="The seed exists for milliseconds. The transaction is permanent."
      steps={steps}
    />

    <LandingFeatures
      title="What the security architecture gives you"
      subtitle="Smaller compliance surface. Shorter breach disclosure."
      features={features}
    />

    <Testimonials
      title="Agencies whose clients asked about security"
      testimonials={testimonials}
    />

    <ComparisonTable
      title="Security architecture vs. the alternatives"
      usLabel="ONE"
      alt1Label="Password-based platforms"
      alt2Label="Self-hosted infrastructure"
      rows={comparisonRows}
    />

    <PricingSection
      client:load
      title="Security is the architecture — not a tier"
      subtitle="Secure Enclave and 8-step enforcement on every plan."
      tiers={tiers}
    />

    <FAQSection
      client:load
      title="Security questions"
      faqs={faqs}
    />

    <SecondaryCTA
      client:idle
      headline="The smaller the attack surface, the shorter the compliance checklist."
      subhead="No passwords. No seed phrases on our servers. GDPR erasure in one command. 8-step enforcement before every signal."
      primaryCta={{ label: 'Read the architecture', href: '#features' }}
      secondaryCta={{ label: 'See the threat model', href: '#comparison' }}
      frictionText="14-day free trial · Secure Enclave on every plan"
    />
  </main>
</Layout>
