Security practices

Controls designed around account isolation, key ownership, and accurate accounting.

Authentication and keys

Sign in with a generated sixteen-digit account key or an email and password. Account keys are shown once, cannot be recovered, and are separate from API keys. Dashboard sessions use HttpOnly cookies and origin checks. Public API requests require separate cryptographic API keys. Raw API keys are displayed once and stored as hashes. Administrative actions require role authorization and MFA.

Financial integrity

D1 is the authoritative balance and ledger store. Conditional transactional writes and per-account Durable Objects protect reservations and settlement. Unique financial references prevent replayed charges and credits. Uncertain usage remains reserved for review.

Minimal data

Activity records exclude prompts, responses, tool payloads, and authorization headers. Worker body logging and tracing are disabled. No advertising trackers are included.

Report a concern

Report suspected vulnerabilities through the operator’s published security contact. Include a concise description, affected endpoint, and safe reproduction steps. Do not access other customers’ data or disclose secrets.

Draft updated October 25, 2026.