What we actually do

A key is shown to you once at creation. What we keep is its SHA-256 digest plus a display prefix (first ten characters, last four); authentication is a lookup by digest, so the plaintext key exists nowhere in the database or the logs.

A key carries a spend cap and reset period, a jurisdiction, a data policy, and a provider allowlist and order. Rotation replaces the digest in place; revoking disables the row and the upstream sub-key with it.

An app sends you to our authorize endpoint; only S256 is accepted, the verifier is never stored, the code is held as its SHA-256 digest, it is burned on the first exchange attempt whether or not that attempt succeeds, and the callback URL is validated against open-redirect abuse before a code is minted.

What is missing: The pending-code store is an in-memory map in one process: codes do not survive a restart, and the flow would need a database-backed store before we run more than one instance. Both failure modes end in “expired code”, never in an issued key.

Clerk holds the session. The proxy protects the account surfaces before a page renders, and a session cookie minted by a different Clerk instance is dropped rather than passed to the verifier, so an old cookie signs you out instead of producing a 500.

Case files and their chunks are filtered by owner id in the query itself, not after the fact, and are retrieved only into your own requests. A matter id you do not own is a 404, so ids are not enumerable.

A master key held in the host environment, never in the database, derives a per-account AES-256-GCM data key and a per-account HMAC index key by HKDF salted with the account id. The account id is also the additional authenticated data, so a row lifted into another account fails the tag check instead of decrypting; search runs over the blind index so it survives encryption.

What is missing: Built and tested, switched on per host. It is off by default, and the blind index has to be backfilled while rows are still plaintext before encryption is turned on. Turning it on first would make search return nothing. /policy reports this host's live state.

If you bring your own upstream key we hold it as an AES-256-GCM envelope under a per-(account, provider) key derived from a separate master key, bound to both by the authenticated data. With the master key unset or malformed, a write is rejected rather than stored readable, and a read fails closed.

Every privileged organisation action writes an audit row with the actor, the action, the target and the request id. Database triggers raise on UPDATE and DELETE against that table on both Postgres and SQLite, so no application code path can rewrite history.

Token buckets per key, per signed-in user and per IP, reported back as X-RateLimit headers with a Retry-After. The OAuth exchange is deliberately the tightest bucket in the API because it is the path that mints credentials.

What is missing: The buckets are per process and in memory, which is correct for one box and would have to move to shared counters before we run more than one.

One usage row per request holds metadata only: key id, model, token counts, cost, latency, citation counts, status, request id, upstream generation id and the provider that served it. Prompt and answer text is stored only if you turn log_content on for that key, which is off by default.

Every request carries data_collection “deny” and an allowlist of providers whose published policy is no-training. A no_retention key adds zdr true; if no zero-retention endpoint can serve the model the request fails with a 503 rather than falling back to a retaining one. A request may only narrow the key's policy; anything wider is a 400.

A key marked private_pod may call in-house models only. No upstream provider object is built because there is no upstream, and with no local model configured the route answers 503 and says that no text was sent anywhere, rather than quietly routing out.

What is missing: It is set by us when a key is attached to a pod, not self-serve, and it needs a local model endpoint on the host. /policy reports whether this host has one.

The scrambler rewrites names, organisations and identifiers in a document to placeholders using a local model and a regex pass; the mapping stays on our machine and the answer is restored from it. A gate refuses to send the document at all if any real identifier it accepted still appears in the scrambled text.

What is missing: It is opt-in per document through its own endpoints (ordinary chat and drafting traffic does not pass through it), and it needs a local model host configured.

A file you upload is frequently not written by you. Text from one is scanned for instruction-override patterns before it reaches the prompt, characters that exist only to hide a payload are stripped, the rest is fenced verbatim, and what was found is reported so a person can look at the exhibit. Evidence is never altered or deleted.

Every citation in an answer is checked against our own offline reporter table first, then a persistent verdict cache, then at most one batched external lookup. A rate limit, a timeout or an exhausted budget returns “unverified”, never “does not exist”. A quoted passage that is not verbatim in the text we hold is replaced in place by a line naming the citation and saying the rule may have been amended, because a superseded quotation and an invented one look identical to a text match and the disclosure has to say so.

A keyless endpoint once served internal store notes to anonymous callers. A test now scans whole public response bodies for repository paths, internal hostnames, absolute paths on our machines, personal addresses and box IP addresses, and fails on any hit, while separately asserting the internal store still holds those notes, so only the published copy is scrubbed. The health endpoint likewise gives anyone a per-check boolean and gives raw error strings, which can name a database host, only to an operator holding the admin token.

The deploy script refuses an uncommitted working tree, type-checks, runs the whole suite and refuses on any failure, then stamps the commit into the build so /api/health reports the exact sha production is serving.

The new build is staged beside the live one and swapped atomically. The script then requires an HTTP 200 on the public site and one real grounded query that returns verified citations; either one failing restores the previous build and restarts the app.

The health endpoint queries the database, runs a real retrieval query that must return hits, and asserts the citation library knows a real citation and does not know an invented one. A synthetic grounded query runs on a schedule and turns health degraded if it fails twice or stops reporting for 45 minutes.

What is missing: Nothing pages a human. The watcher writes a status file and appends to a log, and the alert fires only when the overall state flips, which is how a 17-day outage of the watcher itself went unnoticed. A real on-call path is the first item on the readiness gap list.

Every .env file is gitignored, and a pre-commit hook refuses any commit whose staged content matches a credential shape: provider keys, Stripe keys, webhook secrets, AWS ids, private-key blocks, GitHub and Slack tokens, or a database URL carrying a password. Master keys for case-file and provider-key encryption are read from the process environment and are never written to the database.

A case file's own retention period wins, then the host default; a purge job deletes what is past it and is dry-run unless told to apply. Website page-view rows are deleted after 90 days, and a Do Not Track or Global Privacy Control signal drops the referrer, the IP address, the resolved location and the visitor hash entirely.

What is missing: No host default retention is set today, so a file with no period of its own is kept until you delete it, and the case-file purge is run by hand rather than on a schedule.

A nightly job copies the benchmark bank, the published splits and the local database fallback off the application host to a second machine, keeping fourteen days. Separately, all 36 retrieval shards are archived to object storage and were verified by listing the bucket and comparing every one of 77 objects against its local file byte for byte, not by trusting the archive script's exit code.

What is missing: Neither covers the application database that holds accounts, keys and usage. There is no automated backup of it today; that is the second item on the readiness gap list.