PACINFRAX · RESOURCES

Trust needs evidence.

A clear account of the controls being built, the boundaries they protect and what has not yet been verified.

Not a compliance attestation. No SOC2, ISO27001, production SLA or external penetration-test certification is claimed.

Identity and tenant isolation

Local tests cover signed user access tokens, active organization/project membership checks, hashed scoped project keys and PostgreSQL row-level isolation.

Browser identity primitives are server-only. Real provider enrollment, browser login, MFA and deployed ingress remain unverified.

Credentials and diagnostics

Project keys are stored hashed and scoped. Opaque browser handles are designed to keep provider tokens away from browser storage. Authorization errors must not expose secrets.

Callback logging, edge policies, key custody and production rotation still require operational proof.

Usage integrity

Synthetic PostgreSQL tests exercise atomic usage settlement, deduplication and worker recovery. Local gateway inference is a mock, not a GPU benchmark.

Actual provider reconciliation, payment processing, invoices and commercial rates are not enabled.

Before external access

Approved data region, retention and legal terms.
Verified identity, tenant isolation and privileged access controls.
Load, restore, rollback and incident rehearsals.
Independent security review and explicit go/no-go.

Reporting a suspected issue

During local development, report it directly to the project owner. Include the affected route, sanitized steps and expected behavior. Do not send credentials, customer data or exploit other tenants. A public disclosure channel and response SLA must be verified before launch.