# Security, stated plainly. No badge-wall: the specific, verifiable controls in the product today. Ask hard questions: [hello@pauli.xyz](mailto:hello@pauli.xyz?subject=Security%20question). ## Transport & authentication - **TLS-only ingress.** The API binds to loopback; the only public entrypoint terminates TLS, so bearer keys never travel cleartext. - **Keys are hashed, shown once.** SHA-256 hashes at rest; plaintext returned exactly once, at creation or rotation. Rotation and revocation are instant. - **Workspace isolation on every query.** Scoped at the persistence layer; cross-tenant reads return 404, not 403. - **Per-key rate limiting.** Token buckets in Redis; fail-open or fail-closed is an operator choice. ## Webhooks - **Signed payloads.** Timestamped HMAC-SHA256 (`X-Pauli-Signature`) over the exact payload bytes, so a captured delivery replays only within your verification tolerance; rotations sign with old and new secrets through an overlap window. `X-Pauli-Event-Id` dedupes. - **SSRF guards, twice.** https-only webhook URLs, refused when they resolve non-public (loopback, RFC-1918, link-local, cloud metadata) at submit and re-checked at delivery against DNS rebinding. Always on; no off switch. ## Money & data integrity - **Decimal end-to-end.** Money never passes through floating point; API amounts are exact decimal strings. - **Exactly-once billing, enforced by the database.** Partial unique indexes guard charges, debits, and refunds; retries and redelivery cannot double-bill or double-credit. - **Payments credit on confirmed funds only.** Stripe webhooks are signature-verified with replay tolerance; a status compare-and-swap makes crediting idempotent. - **Append-only audit log.** Key lifecycle, job events, billing, compliance decisions, and failed auth, written in the same transaction as the action. ## Operations - **One source of truth.** Postgres holds all state; losing the queue loses no jobs, results, or money. - **Crash-safe processing.** Workers claim jobs with leases and commit at every phase boundary; sweeps re-derive any work a dead process dropped. - **Verified backups.** Restore-tested on schedule (an unrestored backup is no backup); encrypted copies ship off-host. - **Errors never leak internals.** 5xx bodies carry only a stable code and request id; detail stays in server-side logs. - **Public status page.** Hosted outside our infrastructure at [status.pauli.xyz](https://status.pauli.xyz), so it stays reachable when we are not. ## Compliance posture - **Export-control gate in the router.** Controlled hardware routes only to screened workspaces with a declared jurisdiction; every denial is audited. - **Denied-party screening.** Every screening decision is audited; routing reads it on every request. On SOC 2:** we’ll certify when customers require it, and we complete security questionnaires on request. ## Reporting a vulnerability Email [hello@pauli.xyz](mailto:hello@pauli.xyz?subject=Vulnerability%20report) with reproduction steps. We acknowledge within two business days and take no legal action against good-faith research.