Security & privacy

Every .parc capsule is a ZIP archive with a canonical-JSON manifest, Ed25519-signed at seal time by a key that lives in your repository's .patcharc/ directory and never leaves it.

patcharc verify checks the signature, the manifest structure, and every per-file SHA-256, offline, with no PatchArc account. The trust model is explicit: a capsule proves what it contains and who sealed it, nothing more.

When you share a capsule, the cloud runs the same verification server-side (workers/src/util/parc.ts) before anything is published. A blob that fails verification never reaches an ArcLink; the capsule goes to a terminal failed state and the reason is visible in its status.

The redaction engine ships 13 built-in detectors (AWS keys, JWTs, private-key blocks, and more), env-file rules, and a high-entropy scanner, plus your own regex rules from .patcharc/config.yaml.

Redaction runs before the capsule is sealed, so secrets never enter the artifact in the first place. The redaction report (what rule fired, on which path) is part of the capsule, so a reviewer can see that material was withheld without seeing it.

Bring-your-own-key connections are envelope-encrypted: your provider key is encrypted with a random per-connection DEK, and the DEK is wrapped with a key-encryption key held only by the key-broker worker.

The broker is the only place the plaintext ever exists in memory, only for the duration of one resolution call. Keys are never logged, never returned by any API, and never sent to the AI Gateway. The broker worker has no public route at all.

Managed AI calls go through the Cloudflare AI Gateway with per-request content logging explicitly disabled, so source-bearing prompts are not persisted by the gateway.

The backend is six Cloudflare Workers. Internal workers (key broker, AI orchestrator, capsule pipeline, queue consumers) have their workers.dev URLs disabled and are reachable only through service bindings.

Authentication is bearer-token based. Refresh tokens are stored as SHA-256 hashes, rotated on every use, and revoked on logout. Service tokens are HMAC-signed with enforced one-hour expiry. The browser session is an HttpOnly, Secure, SameSite cookie.

Every tenant-scoped query carries account_id, enforced by middleware. The API applies per-identity rate limits (300/min authenticated, 30/min on public auth endpoints). Queues have consumers with dead-letter queues, so failed events surface instead of vanishing.