Security

The record is built to survive scrutiny, so the system that produces it has to be plain about what it holds.

What is stored

• Policies, mandates, decisions, approvals and records, encrypted at rest, with the customer chain kept per organization.
• Rail credentials your administrator scoped, in a separate secrets store, never in the record.
• Token references and identifiers for cards and transactions.

What is never stored

• Card numbers, expiry dates or security codes. The agent-facing tools reject them; the storage layer has no field for them. This keeps merchants and customers on the lightest PCI questionnaire (SAQ A).
• The funds. Enruta has no balance, no ledger of money, no payout capability.
• The agent’s full transcript. Only the digest the agent chose to include in trace.

People and keys

• Four roles: administrator, approver, auditor, developer. Approvers sign with passkeys.
• Organization signing keys are rotated on a schedule; every rotation is a snapshot in the key store so old records still verify.
• Daily-root checkpoints are signed and published; anyone can keep a copy.

Retention and export

Records are retained for seven years by default and exportable at any time, with the verifier. Leaving Enruta does not weaken a single record you already hold.

Reporting a vulnerability

Write to security@enruta.ai. Coordinated disclosure; acknowledgement within two business days.