Security

Three principles the system is built around

Controls are verified, not assumed. A scheduled job can complete successfully and accomplish nothing — an upstream can return HTTP 200 with an error in the body, a job can catch its own exception and continue. Vaethra runs a set of automated checks that test outcomes rather than exit codes, including a check on the licence filter itself. Findings are recorded on every run with the transition that caused them — appeared, cleared, still open — retained for review, and the open set is published on the status page.

We hold as little of your data as possible. The Terminal and Atropos require no sign-in, so there is no account, no profile and no record of what any visitor viewed. What we hold is public-source records, the sign-in addresses of the people an API customer admits to its workspace, key records, and the enquiries sent through the one form on this site. This limits the impact of any compromise more effectively than any control we could add on top.

Our position is documented, including the gaps. The compliance page lists every framework we do and do not hold, and each page below states what is running and what is planned. If you find a statement here that does not match what you can observe, please tell us at security@vaethra.com.

Take it with you

These pages are also published as one PDF, so a reviewer can attach it to a ticket, read it offline, or put it through a model without clicking through eighteen pages.

Managed infrastructure, two providers, nothing self-hosted

Vaethra operates no servers. There is no operating system to patch, no container image to maintain, and no host that accepts a remote shell.

The practical effect is a smaller attack surface than a self-hosted equivalent: no VPN, no bastion host, no fleet to keep patched. What remains is our application code, our configuration, and the two providers' own controls. Cloudflare maintains SOC 2 Type II, ISO 27001, ISO 27701 and PCI DSS; Supabase maintains SOC 2 Type II. Both cover the infrastructure they operate.

All data encrypted in transit and at rest

The zone is signed with DNSSEC at Cloudflare; the DS record that completes the chain is entered at the registrar when the domain lock lifts, and until then a resolver does not validate it. TLS certificates are issued and rotated automatically. No certificate in the estate is managed by hand, so none can expire unnoticed.

Four classes of caller, each with its own gate

fifteen paths (15) are open without a credential — health, status, uptime, facts, the accuracy record and the backtest ledger, the graph statistics, the enquiry endpoint, the OpenAPI document, the documentation and the two files every crawler asks for. Every endpoint that returns the record itself requires a key or a first-party origin. You can confirm this from outside — a request to /api/v1/events without either returns 401. The count is derived from the gate's own list and published at /api/v1/facts.

Deny by default, and measured rather than asserted

Both figures below are measured by the running system on every request to /api/v1/facts; this page was built against it on 11 October 2026 and the build refuses to publish a figure that has drifted:

• Row-level security is enabled on 92 of 92 tables across the analytical schema and the customer plane. On the customer plane it is forced, the policies are the only route to a row, and the connection that serves customers cannot bypass them.
• The public database role can execute 0 of the 201 database functions. Default privileges are set so that a new function does not arrive publicly executable, and the count is re-measured on every request to /api/v1/facts.

Stated because a reviewer would find it: the connection that serves the public record holds the database owner role, which row-level security does not constrain. Its safety rests on the application — the licence filter in the shared query builders, parameterised statements, and routes that write only to the tables they own — and on the network and TLS restrictions above. Moving that path to a role of its own, as the customer plane already has, is scheduled for 1 January 2027 and is the one item on this page we would rather were stronger today.

Default privileges are configured so that a newly created function does not arrive publicly executable, which prevents the permission set widening again over time.

Writes to the customer plane run only through SECURITY DEFINER functions that check the caller's capability and record an audit event in the same transaction. The public API's own write paths — alert rules, enquiries, the OSINT ingest — each write one table through a parameterised statement; nothing a request carries is executed as SQL.

Four layers of monitoring, running continuously

1. Service health. /api/v1/health and /api/v1/status answer from the running system. Both are public.
2. Per-source health. Every scheduled data fetch records its own outcome — records retrieved, records written, latency, and the reason if it failed. Degraded sources are shown publicly.
3. Scheduled-job health. Every job's last run is checked against its schedule, so a job that stops silently is detected.
4. Data integrity checks. A set of automated checks that test whether work that completed successfully actually accomplished anything — a cursor that reports progress without advancing, a source rewriting unchanged records, a filter matching nothing because a column is empty, or a licence filter that has stopped filtering.

Findings are recorded when a problem appears and again when it clears, with a daily summary of anything still open. Alerts fire on state change rather than on a fixed interval, so the channel stays meaningful.

Delivery, precisely. Alerts are computed and recorded on every run, and a state change is written with the transition that caused it. The open findings are published on the status page and on /api/v1/health as integrity. Outbound delivery goes to the operations mailbox through the platform's email binding; the destination address was verified on 12 September 2026. A transition and the daily digest are sent there; a warning never pages. This paragraph is here because "delivered to an on-call channel" was stated before it was true, and the date it became true is recorded.

What is logged

• Every request made with an issued API key — path, status, row count and timing — retained for 12 months for billing, abuse handling and incident reconstruction.
• Every source run, every scheduled job, and a full revision history for every record, so any figure can be traced back to the fetch that produced it.
• Platform request logs at the edge, retained under the provider's policy.

We do not log what an anonymous visitor viewed. There is no session identity to attach it to.

A server-side request log exists and is filtered per key. It is produced by us on request — during an investigation, or as the audit export named on access control.

Separately, an append-only audit record of privileged actions — role changes, key issue and revocation, member invitation and acceptance, operator status changes, publication — is written in the workspace database. It records the actor, the organisation, the action, the prior and new state and a reason. It is append-only by database grant rather than by convention: no role holds UPDATE or DELETE on it, including ours.

There is not yet a customer-facing console to read either one in. The record exists; the screen does not. Role-based access does exist and is enforced by the database on every request. Single sign-on and SCIM do not exist — they are not built, not configured and not available, and no part of the workspace should be read as offering them.

A small team, with controls sized accordingly

• Production access is limited to the engineering owner. The full list of holders, with grant dates, is available under NDA.
• An automated operating agent assists with operation under the owner's identity and credentials, on the owner's endpoint. It holds no credential of its own and is bound by the same policies.
• Everyone with any access signs a confidentiality undertaking before receiving it, whether employee or contractor.
• Background checks are committed for any role with production access, from the first hire, to the extent applicable employment law permits.
• Security responsibilities will be set out in the engagement terms of every future hire or contractor rather than in annual training nobody reads; today the code of conduct and the information security policy in the policy set bind everyone with access.
• Access is revoked within one business day of a planned departure and immediately on an involuntary one, with rotation of any credential the departing person could have seen.

A team this size has no risk of forgotten contractor access and does not have the separation of duties a large organisation means by the phrase. Both are described in full under access control and development.

Inherited from the infrastructure providers

Vaethra operates no data centre, no office server and no physical infrastructure. Physical and environmental security is the responsibility of the providers, each of which maintains attestations covering it:

• Cloudflare — SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS.
• Supabase, running on AWS — AWS holds SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018 and PCI DSS covering the facilities.

Development endpoints are full-disk encrypted and screen-locked, and are covered by the access control policy. No production data is stored on them.

Ownership, policies and review

• The engineering owner is accountable for security.
• Written policies cover access control, change management, incident response, cryptography, acceptable use, vendor management and business continuity. They are provided under NDA rather than published, because they describe operational detail.
• A risk register records each risk with its likelihood, impact, owner and treatment. It is reviewed quarterly and after any incident.
• This documentation is reviewed quarterly and after any material change. Each page carries the date of its last review.
• Subprocessors are assessed before engagement and reviewed annually. See subprocessors.

Where to send what

Please do not run automated scans against the API without arranging it first. Scanner traffic is indistinguishable from abuse and will be rate-limited and logged as such. Write to us and we will agree a window.