This page separates controls enforced in source from deployment requirements and known limitations. It is not a compliance report or security guarantee.
Last reviewed:
A provider API key is sent to the gateway over HTTPS. The gateway creates a random data key, encrypts the provider key with AES-256-GCM, and stores a wrapped data key with the ciphertext.
The stored envelope requires the separately configured 256-bit master key. One Conductor does not claim that the active implementation uses a managed KMS.
Signed-in API routes use an HttpOnly session cookie. Production cookies are Secure, SameSite=Lax, and host-only. State-changing browser requests must come from an exactly allowed origin.
The production gateway refuses an empty or wildcard browser-origin configuration. CORS reflects only an exact configured origin and never combines credentials with a wildcard.
Provider connections, conversations, Council sessions, Missions, and related records are loaded through the authenticated user identity and checked for ownership before protected operations.
This is an application authorization boundary, not a claim that every possible infrastructure compromise or implementation defect is impossible.
One Conductor records named account events and metered execution data used by current product surfaces.
The current source does not establish a complete, immutable, user-facing record for every attempted provider call. No such claim is made.