Security

​

Authentication

• Bearer token authentication (API keys)
• Ed25519 signatures on all receipts
• HMAC webhook signatures

​

Data Protection

• All data encrypted at rest (AES-256)
• TLS 1.3 for data in transit
• Input/output hashes stored (not raw content)

​

On-Chain Verification

• MMR roots anchored on Solana (immutable)
• Anyone can verify receipts independently
• No single point of trust

​

Key Management

• API keys hashed before storage
• Key rotation with 24-hour grace period
• Session signer keys managed in HSM

​

Compliance

• SOC 2 Type II (in progress)
• GDPR compliant
• No raw inference data stored by default