# Your agent gets access, not the keys.

Vendor keys stay encrypted in a vault, money will stay with the card issuer, and nothing happens without a record you signed with your passkey.

- [Where things stand](/security#not-yet)
- [The consent record](/spec#record)

## Who holds what

- **You**: Your passkey. It approves every sheet and signs every record. No one approves for you.
- **Your agent**: A short-lived token. Scoped to what you approved, used through Suffect's proxy, revocable at once.
- **Suffect's vault**: The vendor key, encrypted. A data key per credential, wrapped by a master key held apart from the database, opened only to forward a call.
- **The card issuer**: Card numbers and funds. Suffect never stores them: a card number is fetched from the issuer at checkout and held in memory only. The card program is being set up.
- **The vendor**: Your account. In your name, with the vendor as the merchant of record.

## Six rules the code keeps

### Access, not the key

Your agent gets a proxied base URL and a short-lived token. A raw key leaves the vault only if you choose it on the sheet.


### Nothing without your passkey

No test mode, internal flag or partner path creates an account, issues a grant or spends money without an approval you signed.


### Every approval is a signed record

Countersigned by Suffect with Ed25519 and chained to your previous record, so it cannot be quietly rewritten.


### Spend capped by your budget

Calls Suffect can price are reserved against your budget before they run, in an exact double-entry ledger; once the budget is spent, calls are refused.


### Signed, identified automation

Every request Suffect's automation sends a vendor carries an RFC 9421 signature: signups, reads of a manifest and its terms, and the runner's browser. A CAPTCHA or a 2FA step goes to you, never solved for you.


### A small surface

Every public route is rate-limited before it does work, the dashboard and this site run no scripts, and credentials never reach a log.


## Reviewed before it ships

1. **One list of sensitive paths** The gateway, the runner, the vault, consent, OAuth, the ledger and this site's key-set proxy are named in one file in the repository.
2. **A threat-model diff with every change to them** What is at risk, what changed in the mitigations, and what was tested, written before the change merges.
3. **An internal audit** An internal audit of the whole codebase on 2026-10-15; every finding was fixed in ten pull requests.

## Where things stand

- Done: Proxied, short-lived grants and the encrypted vault
- Done: Passkey-signed, countersigned consent records
- Done: Signed signups and browser requests at every vendor
- Done: Rate limits on every public route
- Not yet: A SOC 2 report
- Not yet: A penetration test by a third party
- Not yet: The service in production
- Not yet: The card program, and the key-management root behind the vault (a local key stands in)

Done means running on staging, as of 2026-10-20. Found a security problem? Write to [hello@suffect.com](mailto:hello@suffect.com).

---

Canonical: https://suffect.com/security. Every page of this site has a Markdown twin at the same path plus `.md`; the index is https://suffect.com/llms.txt.