ClarioDB Trust Center

Verifiable security, published limits

ClarioDB does not ask for blind trust: each public assurance states its status, evidence, date and assurance level.

JSON Security policy security.txt

Certifications and frameworks

No external certification is currently claimed. The roadmap and permitted wording are permanently documented.

Open the reference document

4Confirmed 1Review 0Critical 0Unknown 2Not covered

ConfirmedAUD-PUB-DEPLOY-001

Published version integrity

Both checksum sets are valid.

View structured evidence

{
    "manifest": {
        "ok": 563,
        "total": 563
    },
    "delivery": {
        "ok": 564,
        "total": 564
    }
}

ConfirmedAUD-PUB-AGENT-001

Pinned Agent and signed responses

The shipped protocol supports pinned identity, anti-replay and signed attestations.

ConfirmedAUD-PUB-RETRY-001

No blind retry after ambiguous mutation

Mutation paths classify ambiguous outcomes and prevent automatic replay.

Not coveredAUD-PUB-ATTEST-001

Public attestation signature

Public Ed25519 signing is not configured yet; the report exposes only its SHA-256.

View structured evidence

{
    "state": "not_configured",
    "public_key_base64": null
}

Not coveredAUD-PUB-CERT-001

External certifications

No CSA STAR, ISO/IEC 27001, SOC 2/SOC 3 or OWASP certification is currently claimed.

ConfirmedAUD-PUB-SESSION-001

Temporary secrets isolated from the PHP session

The browser receives only an opaque session identifier and the PHP session retains only an opaque handle. Derived keys and active credentials are encrypted separately in private runtime storage, time-bounded, and removed on logout.

View structured evidence

{
    "browser_cookie_contains": "opaque_session_id_only",
    "php_session_contains": "opaque_secret_state_handle_only",
    "encrypted_runtime_contains": [
        "derived_vault_key",
        "active_connection_credentials"
    ],
    "encryption": "libsodium_secretbox"
}

ReviewAUD-PUB-RESTORE-001

Restoration

ClarioDB provides asynchronous additive restoration with terminal verification. For Direct connections, recent protected archives can resume from an atomic checkpoint; ambiguous Agent outcomes are never replayed. Destructive replacement and automatic periodic restore tests remain uncovered.

View structured evidence

{
    "coverage": "additive_async_checkpointed"
}