Security at Elektric

Infrastructure and transport

Elektric runs as a Cloudflare Worker using D1, R2, Durable Objects, Workflows, Workers AI, AI Gateway, and related configured services. Public production endpoints use HTTPS; model-provider requests use server-side HTTPS endpoints.

Identity, keys, and secrets

Dashboard authentication uses Google OAuth or email magic links. OAuth tokens are configured for application-layer encryption and magic-link tokens are hashed. Dashboard sessions are separate from project API keys. API keys are shown once, stored as SHA-256 hashes with short prefixes, project-scoped, and revocable. Provider/payment credentials remain in server-side Cloudflare secrets.

Customers must use server-side secret managers and least privilege, review memberships, revoke unused access, and never expose keys in public clients, source control, URLs, logs, analytics, screenshots, or prompts.

Isolation and authorization

API keys retain their ownership and billing scopes. Conversations, Memory, usage and operational records remain isolated within those scopes. Dashboard routes enforce authenticated membership and roles. Conversations and Memory are additionally scoped by customer-defined opaque user/conversation IDs. Customer applications must authorize their end users and avoid personal data in identifiers.

Abuse and resource controls

The Service implements request and message limits, rate limits, globally coordinated concurrency leases, daily request and spend controls, active-file/job limits, provider capacity admission, health gates, and emergency inference controls. Some limiter failure is designed to fail open for availability; billing and authorization remain separate.

Web and file safeguards

Web retrieval restricts schemes and resolved addresses, revalidates redirects, and limits redirects, bytes, pages, queries, and time. Uploads are project-scoped and checked for allowed type, size, and file signature. R2 delivery is private/no-store. Temporary files generally expire after one hour; access denial precedes asynchronous physical deletion. Assets may be pinned for active jobs.

Logging and monitoring

Elektric records request/attempt, routing, provider/model, supplied user/conversation IDs, latency, usage, cost, limits, jobs/Assets and error data. Ordinary request records do not store full chat bodies. Covered raw telemetry older than 90 days is scheduled for deletion; this is not a retention limit for every record or infrastructure log.

Conversation and Memory content persists separately from ordinary telemetry. See the Privacy Policy and the Privacy Policy for storage, provider processing and deletion limitations.

Payments

Card entry and collection occur in Stripe-hosted Checkout. Elektric does not store full card numbers or security codes. It stores payment/settlement references, payer email, amount/status, and ledger records for prepaid balances and financial records.

Development and operations

The repository includes unit, integration, isolation, authorization, billing, routing, provider, and release tests; dependency lockfiles; production smokes; and customer-safe errors. These reduce risk but do not establish certification or guarantee security.

Incidents and vulnerability reporting

Elektric monitors operational failures and maintains incident-oriented code and runbook material. Customers should preserve request IDs and report suspected compromise without sending credentials or sensitive exploit details through an unconfirmed channel.

Current assurance status

Elektric does not claim SOC 2, ISO 27001, HIPAA compliance, PCI certification, FedRAMP authorization, or another independent security certification or attestation. Stripe-hosted card handling does not make Elektric PCI certified. Elektric does not represent suitability for regulated data or safety-critical use without a separate agreement and verified controls.