Security Overview
HoloSignal is designed around evidence boundaries, least privilege, hard budgets, explicit approvals and replayable audit trails.
01
Platform boundary
Application, acquisition and analysis workloads are isolated by purpose and tenant. Relational metadata, bulk evidence and retrieval data use separate protected stores, while atomic controls coordinate run and budget state.
02
Application security
Public acquisition blocks loopback, link-local, private, metadata and internal network targets, revalidates redirects, caps response size and treats source content as untrusted evidence rather than instructions.
Secrets resolve only inside connector workers. API keys are hashed and revealed once. External actions require exact, expiring, one-time approval grants and connector-side idempotency.
03
AI safety
Routine analysis is checked by deterministic evidence, schema, policy and budget controls. Deeper review receives only a compact evidence ledger when a policy gate triggers. Prompt and policy versions are recorded for replay.
04
Reporting
Report suspected vulnerabilities to security@holosignal.xyz. Do not access data that is not yours, disrupt the service, or publicly disclose an issue before coordinated remediation.
Questions or requests?
Email privacy@holosignal.xyz or use the privacy controls in your workspace. General support is available at support@holosignal.xyz.