Security

• Encrypted network connections for browser, API, MCP, and provider traffic.
• API keys displayed once, stored only as hashes, bound to a workspace, and revocable from the developer account.
• Role and workspace authorization rechecked on protected mutations.
• Append-only provenance, decision, revision, tombstone, and audit records.
• Least-privilege, read-only permissions for intelligence delivery and connected sources, including Gmail and Discord.

Data location follows the configured hosting, database, and storage regions for the active deployment. BeliefState does not promise a customer-selected residency region unless that commitment is written into the customer agreement.

Contact antvacation@gmail.com before using BeliefState for a workload with a statutory or contractual residency requirement.

Send a concise report to antvacation@gmail.com with the affected URL, reproduction steps, expected impact, and a safe contact method. Do not access other people’s data, degrade the service, or publish a vulnerability before coordinated review.

Reports are acknowledged after the public support address is configured. Severity and remediation timing depend on verified impact.

Confirmed material incidents affecting customer confidentiality, integrity, or availability will be documented here with the affected period, known scope, containment, and corrective action when disclosure is safe and legally permitted.

No incident entry is currently published. Absence of an entry is not a certification that no security event has ever occurred.

BeliefState does not currently claim a certification, independent penetration-test report, bug-bounty program, or regulated-workload approval on this page. Those claims will appear only after verifiable evidence exists.