Security

Principles

• Source credentials never leave the server. Upstream data-provider keys live in secret storage and are used only server-side. They are never exposed to a browser or a client library.
• Subject identifiers are stored hashed. We keep enough to detect repeat and abusive search patterns, and not enough to constitute a searchable database of consumer identifiers.
• Results expire. Search results are purged on a clock. The search log is kept longer, because that is the compliance record.
• Keys are scoped and revocable per user, not per account, so removing one person does not mean rotating everyone.
• Least privilege by account type. Accounts can only reach data classes their verified purposes support. This is enforced in the request path.
• Everything is logged — including blocked and failed requests.

Infrastructure

The platform runs on Cloudflare’s edge network. There are no long-lived servers to patch, no database exposed to the public internet, and no admin panel reachable without device-level authentication.