Security

A short account of what this server actually does.

• Sign-in is OAuth 2.1 with PKCE. Only the S256 challenge method is accepted. Tokens are bound to this origin.
• Sign-in on this server uses Google. Google sign-in is open. A Google account on the operator list is Comp (team).
• A reviewer demo can be turned on by the operator for a platform review. It is one shared identity, not a private account, so people using it share its checks. It is off unless a server secret is set. It does not use the sign-in above, and it asks for no second factor. It reviews only what that call sends. Its receipts are hashes only, kept up to 90 days, the same as any other account. A real account cannot read another person's checks.
• Content you send is processed in memory only and is never stored.
• Every check can produce a signed receipt (Ed25519). The receipt holds hashes and the outcome only, not the content you shared. Receipts are kept up to 90 days. The public key is at /.well-known/jwks.json.
• Operational logs and security metadata are kept up to 90 days.
• Analytics Engine keeps per-event usage, security and billing records under a monthly-rotating pseudonym for about 3 months, then they are deleted. Each record has the event type, plane, tool category, outcome, card state, module, error code, reason, key whitespace, ruleset version, service version, and a duration band. It has no content.
• D1 keeps the user row until the account is deleted. That row is a pseudonymous id, which sign-in produced it, the plan, the terms and privacy versions accepted, the creation time, and the last day seen.
• D1 keeps connections until the account is deleted.
• D1 keeps consents until the account is deleted.
• D1 keeps the entitlement until the account is deleted. That row holds the same pseudonymous id, the plan, the product, the status, the billing interval, the current period end, whether cancellation is at the period end, the Stripe customer id, the Stripe subscription id, disputed Stripe subscription ids, and the time the row last changed.
• Revoked agent IDs are kept while the account exists and are deleted with the account.
• The session generation counter is kept with no expiry, including after account deletion, so a cookie from before deletion does not match.
• The intro marker is kept with no expiry, including after account deletion, so a later subscription is not treated as a first Pro subscription. It records the first Pro subscription id and the end of the first calendar month of that subscription, or that this account does not get an intro.
• D1 keeps a salted hash of the network bucket for a new account until that signup window ends, and never longer than 90 days. The network address is not stored.
• D1 keeps an internal note when new accounts or checks jump above a trailing baseline. The note is the day, the count, the baseline, and the time it was written. It is kept up to 90 days and stays on this service.
• The control baseline is AI SAFE2. The framework repository is ai-safe2-framework.