Security & a clean exit

How secrets are handled

Secrets never leave the vault

Agents receive a `credential_ref`, never the provider key. Credential access is audited; keys are bcrypt-hashed at rest and shown only once.

Every action is provable

Credential access, LLM cost, and tool decisions write a tamper-evident chain you can verify via `GET /v1/mcp/audit/chain/verify`.

Fail closed

HITL approval timeouts default to deny; high-risk ops require a human. An org-wide kill-switch halts everything at once.

No lock-in

Export your full org — credential metadata, agents, sessions, audit — via the portable export endpoint. Your data is yours to take.

Data residency

Organisations pin a region. Read the options and set yours:

curl https://api.identark.io/v1/orgs/regions \
  -H "Authorization: Bearer csk_ADMIN"

curl -X POST https://api.identark.io/v1/orgs/set-region \
  -H "Authorization: Bearer csk_ADMIN" \
  -d '{"region":"eu"}'

Reporting a vulnerability

Found a security issue? Email security@identark.io — please don't file a public issue for anything exploitable. The SDK repositories carry a SECURITY.md with the current disclosure policy.