Our goal
A full compromise of the web app, the database or an agent sandbox must not yield a single client credential, and every credential has a hard expiry tied to a contract.
How we get there
Isolation: one vault and one key per contract, sandboxes with no network except the tool executor. Least privilege: only the Credential Broker can decrypt, one request at a time. Crypto-shredding: deleting a contract's key makes every copy unreadable. Verifiable audit: a hash-chained log with a daily anchor published on our status page.
Reporting a vulnerability
Report security issues through the form on our security page. Please do not access other clients' data or disrupt the service while testing.