Every significant change, on the record.
Append-only public record of platform deployments, policy changes, admin-level access events, and cryptographic key events — oldest to newest, newest at top. Entries are never edited or deleted; corrections appear as new entries referencing the original.
Fail-mode enforcement wired into Edge Worker
DecryptedToken now carries fail_mode and cache_ttl_seconds. Worker isolate serves cached decrypted key on transient AES-GCM failures (fail_mode=cached), rejects with 503 otherwise (fail_mode=closed). Security events still breach-logged.
Actor: platform
Database type narrowing — billing_plan
'free' removed from billing_plan union (types/database.ts). Valid values are now: developer | starter | pro | enterprise. Corresponds to Supabase check constraint update.
Actor: platform
Kill-switch API + admin panel shipped
POST /api/admin/kill-switch enables super_admin to revoke all active tokens and keys for an org or globally. Two-step confirmation UI in /admin. All activations logged to activity_log.
Actor: platform
Usage anomaly detection (F-15) shipped
Baseline calculation, per-token anomaly scan (rate_spike, error_spike, cost_spike, new_geography, new_endpoint), alert dispatch, and dashboard surface. Runs on cron schedule.
Actor: platform
Key rotation policy + overdue reminders (F-13 slice 1) shipped
rotation_interval_days and last_rotated_at fields on api_keys. Cron scan dispatches email/webhook/Slack reminders for due and overdue keys. Dashboard shows rotation status per key.
Actor: platform
Endpoint scope enforcement (F-14) shipped
Tokens carry an allowed_endpoints list (method + glob pattern). Worker checks request path before rate limiting. Denied endpoints logged to breach_events.
Actor: platform
Acceptable Use Policy updated — AI workloads
Added guidance on acceptable AI-inference use cases proxied through KeyVault Edge. Prohibited uses (CSAM generation, autonomous weapons, mass-surveillance) explicitly enumerated.
Actor: legal
Cost-cap enforcement (F-16) shipped
monthly_cost_cap_micros field in token payload. Worker reads accumulated KV spend counter and returns 402 once cap is reached. Spend tracked via KV with 35-day self-expiry per month.
Actor: platform
Breach detection + IP blocklist (F-07) shipped
domain_mismatch, ip_mismatch, expired, rate_exceeded, invalid_hmac, quarantined, and endpoint_denied events written to breach_events. Dashboard surface with acknowledge workflow.
Actor: platform
Maintenance: Supabase RLS policy audit
Super-admin reviewed all Row Level Security policies across 11 tables. No policy gaps found. Audit trail in internal security log.
Actor: admin@keyvaultedge.com (sanitised)
Paddle billing integration shipped
Paddle replaces Stripe as the primary payment provider. Stripe webhook retained for historical payments. paddle_customer_id added to organizations table.
Actor: platform
HMAC_KEY rotation — scheduled
HMAC signing key rotated as part of scheduled quarterly key rotation. All existing tokens remain valid (HMAC is verified against both current and previous key during a 48h grace window).
Actor: platform
Edge Worker v2 — rate limiting via Durable Objects
Replaced KV-based rate limiting with Durable Object rate limiter for consistent per-token rate windows across edge locations. Fail-open on DO unavailability.
Actor: platform
Privacy Policy — GDPR Article 13/14 notices added
Data subject information notices added per Articles 13 and 14 GDPR. Right-to-erasure request process documented. DPA template published.
Actor: legal
SSRF guard shipped in Edge Worker
Inline isSafeUpstreamUrl() blocks private IP ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16), localhost, and metadata endpoints. Enforced before token decryption.
Actor: platform
Token encryption upgraded to per-token DEK wrapping
AES-256-GCM with per-token Data Encryption Keys wrapped by a master key. HMAC-SHA256 envelope signature. Older tokens (MASTER_KEY-only) migrated.
Actor: platform
Internal security review — employee access audit
All employee and service-account access to production Supabase and Cloudflare reviewed. No unauthorized accounts found. Two stale developer accounts deprovisioned.
Actor: admin@keyvaultedge.com (sanitised)
Terms of Service — SLA and uptime commitment added
99.9% monthly uptime SLO added for Pro and Enterprise plans. Outage credit schedule (5% per 0.1% below SLO) defined. Effective for all customers on Pro/Enterprise as of this date.
Actor: legal
Warrant canary published
First warrant canary statement published at /trust/transparency. Signed 2026-02-01, updated quarterly.
Actor: platform
Public beta launch
KeyVault Edge opened to public beta. Core proxy (token decrypt → inject → forward), organisation model, developer plan, and dashboard shipped.
Actor: platform
MASTER_KEY provisioned — production
256-bit AES master key provisioned and stored in Cloudflare Worker Secrets. Key material never written to disk or logs. Access restricted to Worker runtime and one infrastructure admin.
Actor: platform
Responsible disclosure policy published
Security vulnerability reporting policy, scope, safe-harbor terms, and acknowledgment timeline published at /trust/disclosure.
Actor: legal
KeyVault Edge incorporated
Entity formed. Initial infrastructure provisioned: Cloudflare account, Supabase project, Vercel project, GitHub organisation.
Actor: founders
About this log
Entries are added by the platform automatically (deployments, key events, config changes) or manually by the security/legal team (policy changes, admin access reviews). This log will be programmatically populated from the activity_log table for machine-generated events in a future release. Until then, entries are maintained by hand and reviewed for accuracy before publication.
Spotted an error or missing entry? security@keyvaultedge.com
Related trust documents