> ## Documentation Index
> Fetch the complete documentation index at: https://docs.simplefunctions.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Encryption, secrets handling, audit trail, SSRF protections, and how to disclose vulnerabilities.

## Encryption

| Layer              | Implementation                                                                 |
| ------------------ | ------------------------------------------------------------------------------ |
| At rest            | Postgres data is encrypted at rest by Supabase.                                |
| In transit         | TLS 1.2+ on every public endpoint.                                             |
| BYOK exchange keys | AES-256-GCM with a per-account derived key. The server stores ciphertext only. |
| Webhook signing    | HMAC-SHA256, header `X-SF-Signature: sha256=<hex>`.                            |

## Secrets handling

* **API keys** — stored as Argon2 hashes. The plain secret is shown exactly once on creation, never re-listed by any endpoint.
* **Exchange keys (BYOK)** — ciphertext only. Decryption happens only inside the active cloud tick process and is erased from memory immediately after the tick.
* **Webhook secrets** — generated server-side per endpoint. The dashboard surfaces a one-time view; afterwards the API only returns `signatureScheme: "hmac-sha256"` and `hasSigningSecret: true`, never the secret itself.

## Audit trail

Async workflows attach trace ids so support and audit tooling can correlate a user action, monitor cycle, alert delivery, or portfolio tick across downstream work. See [Provenance](/concepts/provenance).

## Webhook receiver SSRF protection

<Warning>
  Webhook endpoints must be HTTPS. SimpleFunctions blocks private and loopback ranges before fetching:

  * IPv4 private ranges (RFC 1918) and link-local.
  * IPv4 loopback (`127.0.0.0/8`) and IPv4-mapped IPv6 (`::ffff:127.0.0.1`).
  * Single-decimal IP forms (e.g. `2130706433` = `127.0.0.1`).
  * Cloud-metadata endpoints.

  Any host whose DNS resolves to one of those ranges is rejected before fetch. Email **`patrick@simplefunctions.dev`** for the current allow / deny list if you need it for a procurement review.
</Warning>

## Permissions model

Each account has one or more API keys; an active key has the same access as the user that issued it. For scope-limited keys (read-only, MCP-tool allow-list, service-account isolation), email **`patrick@simplefunctions.dev`**.

## Vulnerability disclosure

Found a security issue? Email **`patrick@simplefunctions.dev`** with reproduction steps. We acknowledge reports as soon as we can and work the fix from there. Please do not disclose publicly until a fix has shipped.

## Incident response

Live incidents are posted at **`https://simplefunctions.dev/status`** with timeline and scope. Past incidents stay on the page for reference.

## See also

<CardGroup cols={2}>
  <Card title="Authentication" href="/guides/authentication">
    Auth flavors and BYOK encryption.
  </Card>

  <Card title="Compliance" href="/enterprise/compliance">
    Regulatory posture.
  </Card>

  <Card title="Provenance" href="/concepts/provenance">
    Trace ids and audit correlation.
  </Card>
</CardGroup>