Security

API keysCopy Anchor Link

• Keys are shown once and stored only as a keyed hash (HMAC-SHA-256 with a server-side secret that can be rotated by version).
• Keys can expire, can be revoked one at a time or all at once for an organisation, and can be limited to a list of IP addresses or ranges. The IP check uses the real client address passed on by our trusted proxies. See Authentication.
• A key's access level and model list are enforced on every call. Per-key monthly spend limits are not available yet.
• Cache and duplicate-detection keys are salted per organisation, so one organisation's cached state cannot be reached by another.

In transit and at restCopy Anchor Link

• All traffic uses TLS. Vault supports mutual TLS.
• Request content is not written to disk or logs. Metadata and records are encrypted at rest. Sensitive fields use field-level encryption.
• Passwords are hashed with Argon2id. Console accounts can turn on two-factor authentication (authenticator app codes) and add passkeys.

ContainersCopy Anchor Link

• Images are signed, and each release has a software bill of materials. Vault images can be verified offline.
• Containers run as non-root with a read-only filesystem, all Linux capabilities dropped and no privilege escalation.
• Internal networks have no route to the internet.

AuditCopy Anchor Link

• When the audit log is turned on, every decision leaves a metadata-only record in a hash chain you can verify. See Assurance.
• Administrator actions are written to an append-only, hash-chained audit log.

Reporting a problemCopy Anchor Link

Open a Security report ticket from the console's Support page, or write to support@sthanika.ai with the subject "Security". Include the steps to reproduce and do not include API keys or customer content.

Telemetry on this siteCopy Anchor Link

This documentation site sets no cookies and loads no analytics or third-party scripts. Search runs in your browser. The API reference sends a request only when you use Try it, and only to the sandbox or a gateway on your own machine; the key you paste stays in the browser tab's memory.

Sieve staff accessCopy Anchor Link

Sieve staff use a separate administration site with its own accounts; customer console accounts cannot sign in there. Staff accounts are created only by Sieve administrators, staff sessions expire after at most eight hours, and staff actions are recorded in the audit log above. OAuth provider tokens are encrypted at the application layer.

Next stepsCopy Anchor Link