Chapter 09 / 14

Security and privacy

Trust boundaries

The browser is untrusted, the model is non-authoritative, and provider responses are external input. Sanic validates identity, origin, schema, scope, consent, and idempotency. Models never receive database or external-API credentials and cannot execute SQL or vendor calls.

Sensitive data

Questionnaire and PDF answers stay on-device or transient unless a separately gated, consented feature says otherwise. Voice samples are never stored in Postgres. Passwords and session/reset tokens are stored only as hashes or digests. Logs use allow-listed fields, correlation IDs, coarse outcome labels, and redacted error classes.

Consent and erasure

Memory and voice consent record purpose, wording/version, grant, and revocation. Revocation immediately disables use; provider deletion is tracked separately so the system cannot claim deletion before confirmation. Account erasure covers sessions, tokens, memories, consents, voice references, and identifiers that are not legally required audit evidence.

Public documentation boundary

This site never contains credential values, private keys, signing material, personal records, private incident evidence, exact emergency procedures, or attack-sensitive defensive thresholds. Operators consult access-controlled runbooks for those details.