# Security

This page describes controls that exist in the product today, with links to the
guides that explain each one. For where your data is processed and by whom, see
[Sub-processors](https://sigwise.ai/docs/trust/subprocessors.md).

## Requests and access

- **Signed requests.** Every `/v1` request carries a short-lived token signed
  with your API key's secret. The token lives at most 300 seconds, can be bound
  to one HTTP method and path, and the secret itself is never sent. Tokens in
  the query string are rejected because URLs end up in logs. See
  [Authentication](https://sigwise.ai/docs/guide/authentication.md).
- **Account isolation.** Each request resolves to one account from its API
  key, and data access is scoped to that account's ID. Accounts do not share
  signals, objects, events or answers.
- **Console sign-in.** Passwords are stored as bcrypt hashes and never in
  plain text. Two-factor authentication with an authenticator app is
  available, and its secret is stored encrypted. Signing in with Google or
  GitHub is optional.
- **Rate limits.** Requests are limited per account, and so is the number of
  inline (`wait`) analyses running at once. See [Errors and retries](https://sigwise.ai/docs/guides/errors.md).

## Secrets

- **API key secrets** are encrypted at rest with AES-256-GCM under a versioned
  master key. The server needs the secret to verify a signature, so it cannot
  store only a hash. Master keys can be rotated without invalidating keys, and
  you can rotate an individual key's secret at any time. See [API keys](https://sigwise.ai/docs/guides/api-keys.md).
- **Webhooks** are signed. Each delivery carries an HMAC-SHA256 signature over
  the timestamp and raw body, which your endpoint should verify. See
  [Webhooks](https://sigwise.ai/docs/guides/webhooks.md).

## Message content

**What reaches an analysis provider.** For each analysis, SigWise sends the
provider the object's ID and type, its recent events (type, name, content,
metadata and time), a rolling summary of older events, and the definitions of
the signals being scored. It does not send your API keys, your account email,
your billing data or any other object's events. Which provider analyses an
account is described in [Sub-processors](https://sigwise.ai/docs/trust/subprocessors.md).

**What is stored.** Events are kept according to the retention policy you
choose: forever, for a number of days, or only until an analysis has read them.
Inline checks with `wait` set to `true` can be configured so content is never
written. Answers are kept whichever policy you choose, so reads, rules and
webhooks keep working. See [Data retention](https://sigwise.ai/docs/guides/data-retention.md).

**What is not logged.** The API handlers and the analysis engine do not write
message content to application logs.

## Deletion

One call deletes everything stored about an object: its events, answers,
summary, queued analysis, rule history and webhook deliveries. Billing records
keep the object ID they were charged for, as financial records. See
[Data retention](https://sigwise.ai/docs/guides/data-retention.md#delete-an-objects-data).

By default, delivered webhook records are removed after 30 days, sent email
records after 90 days and rule firing records after 90 days. The billing ledger
is never pruned.

## Transport

The hosted API and console are served over HTTPS.

## Scope

This page describes product controls. It is not a certification report.