← Procurement hub

# Velaru Security Overview (v0)

**Nisaba LLC · Velaru · Patent #64/124,027**  
**Last updated:** August 2026

## Summary

Velaru produces cryptographically signed AI decision receipts with a hash-chained audit log. Public verification runs client-side — the operator cannot alter green checks on `/verify`.

## Data handled

- Message text submitted for classification (optional privacy vault redaction)
- Signed receipt metadata (classification, timestamps, hashes, signatures)
- Policy lock records and pre-dispute bundle enrollment metadata
- API keys stored server-side (hashed registry); customer BYOK public keys only

## Cryptography

- Ed25519 signatures on every chain entry
- SHA-256 hash chain with genesis anchor
- Optional RFC 3161 timestamps (FreeTSA / DigiCert)
- External GitHub gist anchoring for third-party time/place evidence
- BYOK customer co-sign + vendor tri-receipt mode

## Authentication

- `/api/v1/*` — API key required (`X-API-Key` or `Authorization: Bearer`)
- `/carrier/v1/*` — carrier role API key with `carrier_id`
- `/ops/*` — ops token (`VELARU_OPS_TOKEN`)
- Sensitive exports (`/download-log`, `/audit-package`) — API key or ops token

## Webhooks

- HMAC-SHA256 signature in `X-Velaru-Signature` when `webhook_secret` configured
- Automatic retry (1 retry) on delivery failure

## Infrastructure

- Production: Render.com (US), persistent disk for audit log
- Health: `GET /health`
- Logging: structured JSON events; optional Sentry

## Compliance posture

- FRE 707 pre-compliance narrative and export formats
- Found Scripture carrier dossier export spec
- SOC 2: planned (not yet certified)
- DPA: template at `/procurement/dpa`
- Restraint Atom: `POST /tcb/restraint-atom` (one-call counterfactual + Handler binding)
- Layer Stack v1: `/standards/layer-stack`
- Competitive scorecard vs NotaryOS: `/procurement/vs-notaryos`
- Offline verify kit: `/export/offline-verify-kit.json`
- Public key: `/crypto/public-key`

## Contact

- Security: demond@velaru.xyz
- Trust pack: `/trust`