Security

Prompts and responses

Encrypted at rest with AES-256-GCM via Cloak/Ecto. Never written in plaintext.

Encryption keys

Held in environment configuration, never stored alongside the data they protect.

Backups

Daily snapshots of the database volume, kept for 5 days in the same region. The volume is encrypted, and payloads stay encrypted inside the snapshots.

API keys

Stored only as an HMAC-SHA256 hash, keyed with a secret held outside the database. Raw keys are never persisted and are shown once, at creation.

Key prefixes

sk_live_ and sk_test_ identify the environment without exposing the secret.

Detected PII and secrets

On proxied requests, redacted or blocked before the request reaches the provider, according to the rules set on your app.

Not encrypted

Metadata you attach, model and tool names, a tool's error message, token counts and rule decisions. They are stored as sent, so keep personal data out of metadata.

External connections

TLS 1.3 where the client supports it, TLS 1.2 at minimum; older versions are refused. HTTPS enforced on every API endpoint and on the dashboard.

Certificates

Managed by Cloudflare at the edge and by the hosting provider behind it, both with automatic renewal.

Application to database

A private network encrypted at the network layer (WireGuard), never exposed to the public internet.

Dashboard sign-in

Session-based authentication with bcrypt password hashing.

Session cookies

HttpOnly, Secure and SameSite.

Rate limits

20 requests per minute on sign-in, 120 per minute on API endpoints.

Tenant isolation

Every app-scoped request is checked against the signed-in account before any data is read.

Forms

CSRF protection on every form.

Signup abuse

Cloudflare Turnstile, a honeypot field, disposable-email blocking and rate limiting.

Event retention

Starter 30 days, Growth 90 days, Compliance 2 years.

Purge

Expired events are deleted automatically each night by a scheduled job. Your app's Settings shows the stored record count and the next purge cutoff.

Payload sampling

Optional on Growth and Compliance. Guardrails still run on every request — only payload storage is sampled.

Deleting an app

Removes its events, rules and API keys at once.

Deleting your account

From Account › Security, with your password, once no subscription is active or unpaid. Your account and every app, event, rule and key in it are removed at once. Database snapshots that still hold them expire within 5 days.

Hosting

Fly.io. The application and its database both run in the Stockholm region (arn).

Secrets

Held in environment variables. None in source control. Database credentials are rotated via configuration.

Dependencies

Checked for known advisories in CI on every change.

Logging

Structured JSON logs in production, kept in Axiom for 30 days. Prompt and response payloads are never written to them, and request bodies are kept out of error reports.

Uptime

Monitored externally, with live history linked from the status page.

SignalVault is run by a small team, and we'd rather tell you what we don't have than imply otherwise.

SOC 2

Not certified. The controls on this page are documented, and we complete security questionnaires on request.

Automated checks

Every change runs static security analysis (Sobelow) and a dependency audit in CI, and cannot be deployed until both pass.

Evidence exports

CSV and JSON exports of your audit log support your own compliance reviews.