What we actually do — nothing we don't.
This page lists only implemented, verifiable behavior. Where we haven't done the work (a certification, a formal audit), we say so instead of implying it.
Implemented today
API keys are stored as one-way hashes
A generated key (gwk_…) is shown once at creation time. Only its SHA-256 hash is persisted; the raw secret is never stored or logged.
Key and principal revocation
Both an API key (revoked_at) and its principal (disabled_at) can be revoked; both are checked on every authenticated request.
Every integration route requires authentication
The REST and MCP Gateways require an Authorization: Bearer <key> header on every route except /healthz. There is no anonymous integration path.
Immutable Reality history
Historical FactStateVersions, PublicationRecords and Evidence records are never updated or deleted in place; correction creates a new record, never a rewrite.
Exact provenance on every state
Every exact Reality state carries its Authority binding and evidence linkage — which source surface, and which evidence artifact, produced it.
Private data stays private
Tenant watchlists, capture reasons, deployment scopes and priorities are never exposed through the public API, public timestamps, logs, or error messages.
Bounded retry
Retry loops in the capture and delivery paths run under explicit limits, not unbounded retry storms.
Non-enumerating public surface
The one unauthenticated public endpoint (GET /receipts/{id}) returns an identical 404 for a missing, private, or wrong-channel record — it never confirms or denies existence beyond that.
What we do not claim
We have not pursued or obtained the following, and do not represent otherwise:
- SOC 2
- ISO 27001
- HIPAA
- Multi-region high availability
- A published uptime SLA
This page reflects the committed baseline as of the current release. Operational security hardening is an active, separate workstream; this page will be updated as that work lands and is verified — not in anticipation of it.
Reporting a concern
Email Contact email: pending domain / email setup. We do not yet run a public bug bounty program.