# Security

What Qaldy promises about your data and your tools, how each promise is checked, what is not true yet, and how to report a problem. The threat model and the recorded proofs are public.

URL: https://docs.qaldy.com/security/

The promise this site defends:

> **App code never sees a secret, can't reach anything its manifest doesn't name, can't be opened by anyone the share graph doesn't allow, every action lands in a tamper-evident log, and data stays in the workspace's cell.**

We would rather show you the checks than ask you to believe it.

:::cards
- [Threat model](https://docs.qaldy.com/security/threat-model/)
  A STRIDE table for every component: the threat, the mitigation, its status and the proof that checks it, including what one stolen employee account could reach.
- [Proofs](https://docs.qaldy.com/security/proofs/)
  17 automated checks of the model, with the date, place and commit of the last recorded run, and the read-only checks that run against the live cell.
- [How it works](https://docs.qaldy.com/concepts/)
  The sandbox, the gate, permissions, the audit log and approvals in plain words.
- [Stream, export and verify the audit log](https://docs.qaldy.com/guides/audit-export/)
  Keep your own copy, and check it without trusting us.
- [Replace a key, press the panic button](https://docs.qaldy.com/guides/keys-and-panic/)
  Rotate a key without stopping apps, get reminded before it expires, and revoke everything in one step.
- [The exposure check](https://docs.qaldy.com/guides/exposure-check/)
  Every app is questioned like a stranger would before it can get a public link.
- [A bad day](https://docs.qaldy.com/concepts/bad-day/)
  What keeps working, and what never loosens, when Qaldy's API is down.
- [Kazakhstan and data residency](https://docs.qaldy.com/kazakhstan/)
  Where data lives today, the printable statement, and what is still planned.
:::

![The Security screen: the audit chain verified, the audit log with a filter, proofs, secrets listed without their values, and what each app may reach.](https://docs.qaldy.com/screens/security.webp "The Security screen (admins). Verify again recomputes the audit chain. Sample data.")

## What we ask you to check yourself

- **Read the permission sentences** in a plan before you approve. They are the contract.
- **Verify the audit log.** Security, then Verify again, recomputes the hash chain and names the first row that does not match. For a copy you keep, use the [script](https://docs.qaldy.com/guides/audit-export/).
- **Look at what leaves.** Security shows, per app, the connectors it uses, the extra domains you approved and the calls the gate refused.
- **Keep agents read-only** until you need otherwise: use the [read-only address](https://docs.qaldy.com/mcp/) and a read token.
- **Pin the checkpoint key.** Copy the audit checkpoint public key from Security the day you set up, so a later check does not rest on our word.

## What is not yet true

Say it plainly, because trust depends on it:

- **The proofs ran on a development machine**, not on the production cell. A job that runs 15 read-only checks against the live cell from outside exists, but no result of it has been published yet. Until one is, do not read the proofs as a statement about the live cell. See [Proofs](https://docs.qaldy.com/security/proofs/).
- **The audit chain is anchored only in part.** Signed daily checkpoints exist, and events after the newest one can still be rewritten by someone with database access unless you stream the log out. The locked copy of each checkpoint is not on the pilot yet. See [The audit log](https://docs.qaldy.com/concepts/audit/).
- **Key custody.** The gate's and the API's private keys are held in AWS Secrets Manager and injected as environment variables, not in a hardware module. An AWS administrator can read them.
- **One cell, one maintainer.** There is one pilot cell and one person who can ship code to it. [The threat model](https://docs.qaldy.com/security/threat-model/) says what that means for one stolen account.
- **Isolation between tenants** in a dedicated cell (a microVM per tenant) is [[Planned]]. The pilot uses Cloudflare's isolates, which on their own are not a hardened boundary; that is why the gate sits in front of every way in and out.
- **Data residency in Kazakhstan** is [[Planned]]. See [Kazakhstan](https://docs.qaldy.com/kazakhstan/).
- **No outside check.** Nobody outside the team has penetration-tested the pilot, and there is no SOC 2 report or other certification. A test is planned before a public beta.
- **The spending cap** is built and tested but not yet timed on the live cell, and **billing is [[Mock]]**.

## Reporting a problem

If you find a way past any of the promises above, tell us on [Telegram](https://t.me/tairqaldy) with the steps to reproduce it. A person reads every message.

- **In scope:** the console (https://app.qaldy.com), the API (https://cloud-api.qaldy.com), the MCP server (mcp.qaldy.com) and the runtime host (rt.qaldy.com) of the pilot, the gate in front of apps, the way the sandbox and sharing behave for apps running on Qaldy Cloud, the [landing page](https://qaldy.com/cloud) and the [demo](https://demo.qaldy.com).
- **Out of scope:** other products of the company (the Qaldy AI website and its API are a different service), services we use, social engineering of people, physical access, and denial of service by sheer volume.
- Please do not test against other people's workspaces. Make your own, or use the [demo](https://demo.qaldy.com).
- There is **no paid bounty** yet.