Security
An archive is only as good as its integrity guarantees. Here's what VerbaVault enforces — and where the boundary is.
- WORM by construction: No delete or update code path exists; attempts raise ImmutableRecordError.
- Hash-chained audit log: Every write extends a SHA-256 chain; verify_chain() detects tampering.
- API-key auth: X-API-Key on every /v1/* endpoint. Tenant keys are stored only as SHA-256 hashes and are shown exactly once, at claim time; the operator key is compared in constant time.
- Provenance marking: Every record carries its source and ingestion path; stub-provenance records are labeled, never laundered.
- Env-only secrets: Keys and DB paths via environment; structured logs never include payloads.
- TLS at the edge: Terminate TLS at your reverse proxy; the app binds loopback by default.
Known limits (we'd rather you read them here)
- WORM enforcement is application-code-level in v1; DB role permissions, object-lock storage, and off-site replication are roadmap.
- No independent compliance-attorney review of the 17a-4(f) implementation yet — required before enterprise sales.
Questions or a vulnerability to report? Contact us — security reports go to the top of the queue.
