Security, stated plainly.

Transport & authentication

• TLS-only ingress. The API binds to loopback; the only public entrypoint terminates TLS, so bearer keys never travel cleartext.
• Keys are hashed, shown once. SHA-256 hashes at rest; plaintext returned exactly once, at creation or rotation. Rotation and revocation are instant.
• Workspace isolation on every query. Scoped at the persistence layer; cross-tenant reads return 404, not 403.
• Per-key rate limiting. Token buckets in Redis; fail-open or fail-closed is an operator choice.

Webhooks

• Signed payloads. Timestamped HMAC-SHA256 (X-Pauli-Signature) over the exact payload bytes, so a captured delivery replays only within your verification tolerance; rotations sign with old and new secrets through an overlap window. X-Pauli-Event-Id dedupes.
• SSRF guards, twice. https-only webhook URLs, refused when they resolve non-public (loopback, RFC-1918, link-local, cloud metadata) at submit and re-checked at delivery against DNS rebinding. Always on; no off switch.

Money & data integrity

• Decimal end-to-end. Money never passes through floating point; API amounts are exact decimal strings.
• Exactly-once billing, enforced by the database. Partial unique indexes guard charges, debits, and refunds; retries and redelivery cannot double-bill or double-credit.
• Payments credit on confirmed funds only. Stripe webhooks are signature-verified with replay tolerance; a status compare-and-swap makes crediting idempotent.
• Append-only audit log. Key lifecycle, job events, billing, compliance decisions, and failed auth, written in the same transaction as the action.

Operations

• One source of truth. Postgres holds all state; losing the queue loses no jobs, results, or money.
• Crash-safe processing. Workers claim jobs with leases and commit at every phase boundary; sweeps re-derive any work a dead process dropped.
• Verified backups. Restore-tested on schedule (an unrestored backup is no backup); encrypted copies ship off-host.
• Errors never leak internals. 5xx bodies carry only a stable code and request id; detail stays in server-side logs.
• Public status page. Hosted outside our infrastructure at status.pauli.xyz, so it stays reachable when we are not.

Compliance posture

• Export-control gate in the router. Controlled hardware routes only to screened workspaces with a declared jurisdiction; every denial is audited.
• Denied-party screening. Every screening decision is audited; routing reads it on every request.

Reporting a vulnerability

Email hello@pauli.xyz with reproduction steps. We acknowledge within two business days and take no legal action against good-faith research.