Current controls
- HTTPS is required at the public edge; the API sets HSTS, MIME-sniffing, frame, referrer, permissions, and frame-ancestor protections.
- Account, API-key, and billing operations are authenticated or signature-verified according to endpoint.
- Cross-origin browser access uses an explicit allowlist rather than a wildcard default.
- Client-error reporting is origin-checked, body-size-capped, rate-limited, and intended for an operator-controlled relay.
- Vault is the persistence engine; local/self-hosted deployments keep the operator in control of the database and encryption configuration.
Customer responsibilities
Protect credentials and API keys, use least privilege, rotate compromised secrets, configure backups, review logs, and choose a deployment appropriate to the data classification. Cloud health and HTTP status are not proof of data correctness or authorization.
No certification claim: Cloud is not represented by this page as CMMC certified, ATO-authorized, cATO-authorized, classified, or suitable for CUI. Public government materials describe owner-published readiness/self-assessment claims and separate local/on-premises deployment boundaries.
Vulnerability reporting
Do not open a public issue for a suspected vulnerability. Email [email protected] with the affected route/version, reproduction steps, impact, and suggested mitigation. We aim to acknowledge reports within 48 hours. Do not include secrets or live customer data in a report.
Operational disclosure
The public API exposes health and OpenAPI metadata. Policy routes on the API host redirect to these documents so clients and auditors do not have to guess where the current policy boundary lives. Authenticated operations and payment workflows remain untested by public read-only probes.
Incident and change handling
Security incidents are triaged by impact and scope. We may rotate keys, restrict access, pause a route, or publish an advisory. The effective date on this page changes when the stated service boundary or controls materially change.
Related documents
See the privacy, retention, and telemetry policies, plus the repository security policy.