How we protect your decisions.

• →Local-first capture. HODL events are processed on your device. Cross-device sync is opt-in and end-to-end encrypted — only your devices hold the key.
• →On-device AI tagging.Reasoning extraction (decision stance, blockers, next-step) runs on Chrome's Gemini Nano locally. Tab text never leaves the device for tagging.
• →Hosted plane is minimal. Authenticated metadata and shared sessions live in Supabase Postgres with row-level security; payment events go through Stripe.

• →EdDSA-signed Resume Tokens. Every token is a JWS-signed JWT issued by api.unihodl.app, bound to a single audience (e.g., claude.anthropic.com), and scope-restricted. Tokens cannot be replayed against other audiences.
• →JWKS rotation. Public verification keys are published at /.well-known/jwks.jsonand rotated without breaking issued tokens.
• →API keys hashed at rest. SDK keys (uh_live_…) are stored as SHA-256 hashes; the raw key is shown once at creation and never again. Last-four is surfaced in the dashboard for identification.
• →Step-up auth for sensitive ops. Hand-off and write:next_step require the human to confirm in-app within the last 5 minutes.

• →Server-side at the boundary.Redaction policies (PII, PHI, financial-domain hosts, custom tag classes) run during hydration, before serialization. Agents never see content they aren't entitled to.
• →Auditable. Each /hydrate call produces an immutable audit_record with payload fingerprint, policy version, and the list of fields removed. Unredacted payloads are never logged.

• →Per-workspace audit log. Every mint / hydrate / revoke / handoff is recorded with audit_id, JTI, scopes, audience, status, and fingerprint. Available via the dashboard for owners and admins.
• →Revocation is immediate. Defense-in-depth JTI revocation list is checked on every /hydrate before the max_hydrations counter. Revoked tokens fail with invalid_token.

• →HSTS preload, X-Content-Type-Options, X-Frame-Options, strict Referrer-Policy, locked-down Permissions-Policy on every response.
• →Per-workspace and per-token rate limits (300/min mint, 60/min hydrate, 10K/day cap) with leaky-bucket bursts.
• →Webhook deliveries are HMAC-SHA256-signed with per-endpoint secrets; signatures sent in X-Unihodl-Signature.

Found something? We pay attention. Email security@unihodl.app with reproduction steps. We'll acknowledge within 48 hours and coordinate a fix and disclosure timeline. We don't pursue legal action against good-faith research.

PGP key on request.