[{"data":1,"prerenderedAt":548},["ShallowReactive",2],{"navigation":3,"/security/compliance":258,"/security/compliance-surround":545},[4,22,63,85,115,131,219,245],{"title":5,"path":6,"stem":7,"children":8,"page":21},"Getting Started","/getting-started","1.getting-started",[9,13,17],{"title":10,"path":11,"stem":12},"Introduction","/getting-started/introduction","1.getting-started/1.introduction",{"title":14,"path":15,"stem":16},"Quick Start","/getting-started/quick-start","1.getting-started/2.quick-start",{"title":18,"path":19,"stem":20},"Key Concepts","/getting-started/key-concepts","1.getting-started/3.key-concepts",false,{"title":23,"path":24,"stem":25,"children":26,"page":21},"Guides","/guides","2.guides",[27,31,35,39,43,47,51,55,59],{"title":28,"path":29,"stem":30},"Quick Share Guide","/guides/quick-share","2.guides/1.quick-share",{"title":32,"path":33,"stem":34},"Slack Integration","/guides/slack-integration","2.guides/2.slack-integration",{"title":36,"path":37,"stem":38},"Enterprise Setup","/guides/enterprise-setup","2.guides/3.enterprise-setup",{"title":40,"path":41,"stem":42},"Creating a Share","/guides/creating-a-share","2.guides/4.creating-a-share",{"title":44,"path":45,"stem":46},"Zero-Knowledge Custody","/guides/zero-knowledge-custody","2.guides/5.zero-knowledge-custody",{"title":48,"path":49,"stem":50},"Secure Requests","/guides/secure-requests","2.guides/6.secure-requests",{"title":52,"path":53,"stem":54},"Receiving a Secure Request","/guides/receiving-a-secure-request","2.guides/7.receiving-a-secure-request",{"title":56,"path":57,"stem":58},"SecurePaste","/guides/securepaste","2.guides/8.securepaste",{"title":60,"path":61,"stem":62},"Notifications","/guides/notifications","2.guides/9.notifications",{"title":64,"icon":65,"path":66,"stem":67,"children":68,"page":21},"Account","i-lucide-user-cog","/account","3.account",[69,73,77,81],{"title":70,"path":71,"stem":72},"Signing In","/account/signing-in","3.account/1.signing-in",{"title":74,"path":75,"stem":76},"Plans and Share Allowance","/account/plans-and-share-allowance","3.account/2.plans-and-share-allowance",{"title":78,"path":79,"stem":80},"Billing and Subscription","/account/billing-and-subscription","3.account/3.billing-and-subscription",{"title":82,"path":83,"stem":84},"Plans and Limits","/account/plans-and-limits","3.account/4.plans-and-limits",{"title":86,"icon":87,"path":88,"stem":89,"children":90,"page":21},"Teams","i-lucide-users","/teams","4.teams",[91,95,99,103,107,111],{"title":92,"path":93,"stem":94},"Teams and Contexts","/teams/teams-and-contexts","4.teams/1.teams-and-contexts",{"title":96,"path":97,"stem":98},"Members, Roles and Seats","/teams/members-roles-and-seats","4.teams/2.members-roles-and-seats",{"title":100,"path":101,"stem":102},"Joining a Team","/teams/joining-a-team","4.teams/3.joining-a-team",{"title":104,"path":105,"stem":106},"Custom Branding","/teams/custom-branding","4.teams/4.custom-branding",{"title":108,"path":109,"stem":110},"Policy and Audit","/teams/policy-and-audit","4.teams/5.policy-and-audit",{"title":112,"path":113,"stem":114},"Zero-Knowledge for Teams","/teams/zero-knowledge-for-teams","4.teams/6.zero-knowledge-for-teams",{"title":116,"path":117,"stem":118,"children":119,"icon":130},"Help","/help","5.help/0.index",[120,122,126],{"title":121,"path":117,"stem":118},"Help and Support",{"title":123,"path":124,"stem":125},"Link Not Working","/help/link-not-working","5.help/1.link-not-working",{"title":127,"path":128,"stem":129},"Error Messages","/help/error-messages","5.help/2.error-messages","i-lucide-life-buoy",{"title":132,"path":133,"stem":134,"children":135},"API Reference","/api","6.api/0.index",[136,137,141,167,189,193,211,215],{"title":132,"path":133,"stem":134},{"title":138,"path":139,"stem":140},"Authentication","/api/authentication","6.api/1.authentication",{"title":142,"path":143,"stem":144,"children":145},"Shares","/api/shares","6.api/2.shares/0.index",[146,147,151,155,159,163],{"title":142,"path":143,"stem":144},{"title":148,"path":149,"stem":150},"Create a share","/api/shares/create","6.api/2.shares/1.create",{"title":152,"path":153,"stem":154},"List shares","/api/shares/list","6.api/2.shares/2.list",{"title":156,"path":157,"stem":158},"Retrieve a share","/api/shares/retrieve","6.api/2.shares/3.retrieve",{"title":160,"path":161,"stem":162},"Expire a share","/api/shares/delete","6.api/2.shares/4.delete",{"title":164,"path":165,"stem":166},"Client-side encryption","/api/shares/client-side-encryption","6.api/2.shares/5.client-side-encryption",{"title":168,"path":169,"stem":170,"children":171},"Secure requests","/api/requests","6.api/3.requests/0.index",[172,173,177,181,185],{"title":168,"path":169,"stem":170},{"title":174,"path":175,"stem":176},"Create a request","/api/requests/create","6.api/3.requests/1.create",{"title":178,"path":179,"stem":180},"List and retrieve requests","/api/requests/list","6.api/3.requests/2.list",{"title":182,"path":183,"stem":184},"Read submissions","/api/requests/submissions","6.api/3.requests/3.submissions",{"title":186,"path":187,"stem":188},"Expire or delete a request","/api/requests/delete","6.api/3.requests/4.delete",{"title":190,"path":191,"stem":192},"Stats","/api/stats","6.api/4.stats",{"title":194,"path":195,"stem":196,"children":197},"Webhooks","/api/webhooks","6.api/5.webhooks/0.index",[198,199,203,207],{"title":194,"path":195,"stem":196},{"title":200,"path":201,"stem":202},"Event reference","/api/webhooks/events","6.api/5.webhooks/1.events",{"title":204,"path":205,"stem":206},"Verifying signatures","/api/webhooks/verifying-signatures","6.api/5.webhooks/2.verifying-signatures",{"title":208,"path":209,"stem":210},"Delivery and retries","/api/webhooks/delivery-and-retries","6.api/5.webhooks/3.delivery-and-retries",{"title":212,"path":213,"stem":214},"MCP server","/api/mcp","6.api/6.mcp",{"title":216,"path":217,"stem":218},"Errors and Rate Limits","/api/errors-and-limits","6.api/7.errors-and-limits",{"title":220,"path":221,"stem":222,"children":223},"SDKs","/sdks","7.sdks/0.index",[224,225,229,233,237,241],{"title":220,"path":221,"stem":222},{"title":226,"path":227,"stem":228},"Node SDK","/sdks/node","7.sdks/1.node",{"title":230,"path":231,"stem":232},"Python SDK","/sdks/python","7.sdks/2.python",{"title":234,"path":235,"stem":236},"Go SDK","/sdks/go","7.sdks/3.go",{"title":238,"path":239,"stem":240},"Rust SDK","/sdks/rust","7.sdks/4.rust",{"title":242,"path":243,"stem":244},"Conformance vectors","/sdks/conformance-vectors","7.sdks/5.conformance-vectors",{"title":246,"path":247,"stem":248,"children":249,"page":21},"Security","/security","8.security",[250,254],{"title":251,"path":252,"stem":253},"Encryption","/security/encryption","8.security/1.encryption",{"title":255,"path":256,"stem":257},"Compliance","/security/compliance","8.security/2.compliance",{"id":259,"title":255,"api":260,"body":261,"description":539,"extension":540,"links":260,"meta":541,"navigation":542,"path":256,"seo":543,"stem":257,"__hash__":544},"docs/8.security/2.compliance.md",null,{"type":262,"value":263,"toc":526},"minimark",[264,277,280,285,326,330,352,356,375,379,393,397,435,439,442,474,478,509,513,519],[265,266,269],"callout",{"color":267,"icon":268},"info","i-lucide-info",[270,271,272,276],"p",{},[273,274,275],"strong",{},"CredenShare is SOC 2 aligned, not SOC 2 certified."," Our controls are designed against the Trust Service Criteria, but no auditor has attested to them and we hold no report to send you. Certification is on the roadmap.",[270,278,279],{},"What follows is what is actually built, so you can judge the parts that matter to you rather than take a status table on trust. The last section lists what we do not have — a compliance page that only lists strengths is not a compliance page.",[281,282,284],"h2",{"id":283},"encryption-you-dont-have-to-trust-us-on","Encryption you don't have to trust us on",[286,287,288,296,308,311,318],"ul",{},[289,290,291,292,295],"li",{},"Content created in the web app or through the API is encrypted ",[273,293,294],{},"in the client, before the request"," — AES-256-GCM under a per-share content key. The key travels in the share link's URL fragment, which browsers never transmit, so it does not reach our servers, our logs, or our database.",[289,297,298,299,302,303,307],{},"The API ",[273,300,301],{},"enforces"," this rather than encouraging it: a create must declare ",[304,305,306],"code",{},"e2ee-aes256-gcm"," and carry ciphertext, and a plaintext payload is rejected.",[289,309,310],{},"What we store for a client-encrypted share is ciphertext plus a SHA-256 hash of an access token. When a share is passcode-protected, the passcode is replaced on the wire by a one-way verifier — we can count failed attempts while holding nothing that helps us decrypt.",[289,312,313,314,317],{},"Credentials sent through the ",[273,315,316],{},"Slack app"," are encrypted on our servers instead, with keys in a managed key service. We can decrypt those. We say so plainly rather than implying otherwise.",[289,319,320,321,325],{},"The wire and crypto formats are pinned by a ",[322,323,324],"a",{"href":243},"normative conformance-vector suite"," that every official SDK — Python, Node, Go, Rust — must reproduce byte for byte in its own test run. A client that drifts from the spec fails its build rather than silently producing content nobody can read back.",[281,327,329],{"id":328},"the-share-access-log","The share access log",[286,331,332,335,342,345],{},[289,333,334],{},"Every open of a share writes an access-log row: timestamp, IP, platform, user agent, the accessing account where there is one, and whether a passcode attempt failed.",[289,336,337,338,341],{},"Access logs ",[273,339,340],{},"survive the share",". When a share expires its record keeps the original identifier, so the access history stays intact and readable after the content itself is gone.",[289,343,344],{},"Owners can read the history per share, or export a whole account's log over a date range. The export is scoped to the caller — you get your own trail, never anyone else's.",[289,346,347,348,351],{},"The retention window is enforced ",[273,349,350],{},"server-side",": the API clamps the requested start date to your plan's window and reports the range it actually applied, so a modified client cannot reach further back than the plan allows. Exports are capped per request and flag themselves when truncated.",[281,353,355],{"id":354},"deletion-that-is-a-real-delete","Deletion that is a real delete",[286,357,358,365,372],{},[289,359,360,361,364],{},"Expiry is a hard ",[304,362,363],{},"DELETE",", not a hidden flag. There is no soft-delete column on the share record, so an expired share's payload is gone from the database rather than filtered out of queries.",[289,366,367,368,371],{},"The expiry sweep runs ",[273,369,370],{},"hourly"," in production, and also immediately when an expired share is opened.",[289,373,374],{},"What we retain after expiry is a metadata record — title, settings, whether a passcode was set — deliberately built as an explicit list of fields so that secrets cannot be added to it by accident. The encrypted payload, the passcode, the passcode verifier and the access-token hash are all excluded.",[281,376,378],{"id":377},"where-your-data-lives","Where your data lives",[286,380,381,387,390],{},[289,382,383,386],{},[273,384,385],{},"Single region: US East (N. Virginia)."," All databases and object storage are provisioned there and nowhere else. We do not currently offer alternate regions; if you need one, that is a conversation, not a setting.",[289,388,389],{},"The production database is encrypted at rest under a customer master key in AWS KMS, with 7-day automated backup retention.",[289,391,392],{},"Backend secrets live in AWS Secrets Manager and are fetched at runtime. Production functions carry only the identifier of the secret in their configuration — no database credentials, no API keys, no signing material in environment variables.",[281,394,396],{"id":395},"connections","Connections",[286,398,399,414],{},[289,400,401,402,405,406,409,410,413],{},"The web app, share and paste hosts require ",[273,403,404],{},"TLS 1.2 or better"," — TLS 1.0 and 1.1 handshakes are refused — and send HSTS with ",[304,407,408],{},"includeSubDomains"," and ",[304,411,412],{},"preload",".",[289,415,416,417,420,421,420,424,427,428,431,432,413],{},"Every page ships a Content Security Policy with ",[304,418,419],{},"object-src 'none'",", ",[304,422,423],{},"base-uri 'self'",[304,425,426],{},"form-action 'self'"," and a restrictive ",[304,429,430],{},"frame-ancestors",", plus ",[304,433,434],{},"X-Content-Type-Options: nosniff",[281,436,438],{"id":437},"controls-you-can-turn-on","Controls you can turn on",[270,440,441],{},"These are account controls available to you today, not descriptions of our internal practice.",[286,443,444,450,456,462,468],{},[289,445,446,449],{},[273,447,448],{},"Multi-factor authentication"," is available on every account: an emailed one-time code, an\nauthenticator app (TOTP), or SMS. It is optional rather than mandatory — you choose whether to\nenable it, and we do not claim it is enforced across all accounts.",[289,451,452,455],{},[273,453,454],{},"Per-share limits."," A share can require a passcode, expire at a chosen time, cap how many times\nit may be viewed, and be restricted to particular email domains or source addresses.",[289,457,458,461],{},[273,459,460],{},"Scoped API keys."," A key carries only the scopes you grant, matched exactly with no hierarchy\nand no wildcards, and it cannot mint or widen another key. Key management stays on the\nsession-authenticated app surface for that reason.",[289,463,464,467],{},[273,465,466],{},"Custody is opt-in for API-created shares."," By default a share created through the API is\nreadable only by whoever holds the link — not from your own dashboard, and not by us. Storing a\nrecoverable copy is a deliberate choice you make per share.",[289,469,470,473],{},[273,471,472],{},"Signed webhooks."," Deliveries carry an HMAC-SHA256 signature over the timestamp and raw body,\nwith a per-endpoint secret that is randomly generated and sealed. Rotation runs a 24-hour window\nwhere both the old and new secrets sign every delivery, so a receiver can be updated without\ndropping events.",[281,475,477],{"id":476},"what-we-do-not-have-yet","What we do not have yet",[286,479,480,486,492,498],{},[289,481,482,485],{},[273,483,484],{},"No SOC 2 report, ISO certificate, HIPAA BAA or third-party penetration-test report."," If a vendor questionnaire asks for one, the honest answer is that we have none.",[289,487,488,491],{},[273,489,490],{},"No published SLA or uptime measurement."," The production database is single-AZ.",[289,493,494,497],{},[273,495,496],{},"Internal access controls are being rebuilt."," Administrative access to our cloud account is not yet behind enforced MFA or just-in-time role assumption, and account-level API audit logging is not yet enabled. This is our top-priority security work, and this page will be updated when it lands rather than before.",[289,499,500,503,504,508],{},[273,501,502],{},"GDPR data-subject requests are handled manually."," Mail ",[322,505,507],{"href":506},"mailto:security@credenshare.io","security@credenshare.io",". We have no automated export or erasure endpoint, and we do not quote a turnaround we cannot yet measure.",[281,510,512],{"id":511},"reporting-security-issues","Reporting security issues",[270,514,515,516,518],{},"If you discover a vulnerability in CredenShare, please report it responsibly to\n",[322,517,507],{"href":506},". We will confirm receipt and keep you\nupdated while we work on it.",[520,521],"docs-cta",{"buttonLabel":522,"buttonTo":523,"description":524,"title":525},"Talk to us","https://credenshare.io/contact","We will answer a security questionnaire directly, and tell you plainly where the answer is \"not yet\".","Evaluating CredenShare for your team?",{"title":527,"searchDepth":528,"depth":529,"links":530},"",1,2,[531,532,533,534,535,536,537,538],{"id":283,"depth":529,"text":284},{"id":328,"depth":529,"text":329},{"id":354,"depth":529,"text":355},{"id":377,"depth":529,"text":378},{"id":395,"depth":529,"text":396},{"id":437,"depth":529,"text":438},{"id":476,"depth":529,"text":477},{"id":511,"depth":529,"text":512},"What CredenShare's security controls actually are today — what is built, what is not, and what we can show you.","md",{},true,{"title":255,"description":539},"PNoq86micieDbKa0GIa_FlZHkGORPRu6V1hFJ1LU2oo",[546,260],{"title":251,"path":252,"stem":253,"description":547,"children":-1},"How CredenShare encrypts and protects your shared credentials.",1788908846767]