Security

Draft disclosure

Not effective. No approved legal entity.

Version

draft-1

Source inventory reviewed

2026-10-22

Effective date

Not effective; no approved policy date.

Responsible entity

Legal entity: unconfirmed. AGINDOW is the project name.

Contact

Legal contact: unconfirmed. General project contact: support@agindow.com; not a verified rights-request channel.

No deployed inventory approval, policy approval or provider/transfer approval is recorded. These pages describe project implementation boundaries, not an operative privacy policy, binding terms or a production assurance. The public site may be served while this record stays incomplete; trust paths stay noindex until a source-reviewed release replaces the draft.

Precise controls. Explicit limits.

Customer fallback keys

Presented secrets have a one-time reveal. Stored verification uses scoped, versioned HMAC digests; metadata retries cannot recover the secret. Production machine scopes are empty. This differs from recoverable service credentials.

Recoverable service secrets

The design requires versioned authenticated encryption for recoverable secrets. Current billing and mail integrations resolve secrets from explicit host vault ports; no universal encrypted-at-rest vault is shipped or qualified here. Hosts own key custody, rotation and storage enforcement.

Transport protection

HTTPS origins and Secure cookies are configured. The deployment host must qualify TLS, service bindings and secret delivery. Loopback/Unix sidecar transport is a separate local boundary; TLS is not asserted for every local hop.

Payload processing

Inspection can read payload bytes and audit evidence can contain sensitive data. Bounded capture is not redaction. Profiles and optional raw samples require their own handling controls; there is no blanket no-payload claim.

Detection limits

Detection is off until you configure it. Statistical detection needs explicit qualified windows; unchanged distributions can hide meaning changes. Engine faults bypass inspection, reads fail open, and a response halt cannot undo an upstream write.

Assurance

No independent audit, certification, penetration-test report or compliance attestation is claimed. Hosted security, live providers, distributed replay and production traffic are not qualified.

Before launch the owner must approve a security reporting contact, incident handling process, transport and storage controls, log redaction and provider inventory. The general project address is not an established security-response SLA.