Security model ยท version 0.2.0
Exact guarantees.
Accord Trace is a service attestation over an immutable evidence-hash record. The boundary is deliberately narrow.
Integrity
Evidence is represented by SHA-256. Strings are hashed as exact UTF-8; JSON uses deterministic sorted-key canonicalization. Verification can detect whether supplied content produces a different digest.
Service attestation
The proof payload is signed using ECDSA P-256 with SHA-256 (ES256). The public trust anchor is published as JWK at /.well-known/jwks.json. A valid signature means the configured Accord Trace key attested to the record.
Timestamp
timestamp is the Accord Trace service recording time. It is not an independently witnessed timestamp and currently has no external transparency-log or blockchain anchor.
Storage
Raw submitted content is hashed in memory and not stored. Stored proof records contain the evidence hash, public metadata, recording time, issuer and attestation. Proof records have no update or delete API.
Threat controls
Inputs have byte, depth and key-count limits. The service never evaluates submitted content as code, never builds prompts from it and never fetches user-supplied URLs. SQL uses bound parameters. Proof IDs contain 144 random bits. Anonymous calls are rate limited using salted client hashes.
Not guaranteed
A proof does not establish truth, authorship, identity, authority, fairness, legality, completeness, absence of off-path actions, or an independent timestamp. Endpoint compromise or signing-key compromise can undermine service attestations.
Key operations
The private signing JWK is supplied as a deployment secret and is never returned by an endpoint or stored in the repository. Historical verification requires retaining previous public keys when rotating a production signing key.
Report issues
Security reports may be sent to replace-before-launch@example.invalid. Do not include production secrets in a report.