Security.

Reporting a vulnerability

Send it to security@1muse.example. Please include enough detail to reproduce. We will acknowledge within two working days and will not pursue anyone acting in good faith against their own account.

Design commitments

• Credentials are sealed with a per-user data key, itself wrapped by a key in a cloud HSM.
• There is no API that returns a stored credential value — to you, or to our support team.
• Policy is evaluated before a credential is unwrapped, so a denied call never materialises a secret.
• Ledger entries are append-only and each seals the previous one, so silent edits are detectable.
• Agent keys scope a client to its grants. On their own they unwrap nothing.

What we do not claim

There are no certifications on this site. We are not SOC 2 audited, not ISO 27001 certified, and have not had a third-party penetration test. When any of that changes it will be stated here with a date and an auditor, and not before.