aisthetic·servicesSecurity is a product feature. Arc testnet (private design-partner alpha). Not a checkbox.
Four invariants that hold whether one agent calls or a fleet does. Plus a frank list of what we do not claim. The fastest way to build trust with a security buyer is to surface the boundary, not hide it.
Four invariants
1. Zero custody
We never hold funds. Receipts are signed via a Signer port; the production signer (env) loads an Ed25519 key from a secret manager, held in process and never committed to source. Ephemeral signers are refused in production without an explicit override. A KMS/HSM-backed signer is a follow-on (AWS KMS does not support Ed25519).
2. Zero leakage
A 24-pattern leak scanner runs over every artefact before it can leave the gateway. Bodies are sha256-hashed by default. Bearer tokens, storage refs, JWT shapes, PEM headers, and DB credential URIs all fail the scan.
3. Tamper-evident
Receipts are Ed25519-signed and indexed. The audit log is append-only and hash-chained per provider. Proof bundles verify offline against a published public key, no contact with us required.
4. Bounded by design
Every external surface uses a single bounded enum vocabulary, mirrored across CLI, docs, and this site. If a capability cannot be expressed in that vocabulary, it does not ship.
On-chain anchor
In this private design-partner alpha the primary payment rail is Arc testnet (operator-gated). A dormant Solana lane is preserved: its receipt verifier is anchored on Solana with an immutable Anchor program (upgrade authority null) that verifies receipt hashes on-chain. The artefacts below are real and remain verifiable; they are kept as proof, not framed as a live production rail.
| Anchor | Address / signature | Status |
|---|---|---|
| Anchor program | FWdCDkFnex…vw9Z (Solscan) | Immutable |
| Recipient ATA | Hbzx5A9M…s11A (Solscan) | Dormant lane |
| First mainnet canary | 4N9XggyC…gQaY (Solscan) | Verified |
External operator verification — not_ready
The compatibility lanes the gateway depends on are operator-gated. They have not been run against a real customer’s credentials, so external operator verification is not_ready — matching the posture in the brand caveat. The lane composition below is the substrate that is ready to exercise, not a completed verification claim.
| Lane | Status | Receiver |
|---|---|---|
| Signed webhook external delivery | passed | real third-party Cloudflare Worker |
| x402 funded testnet settle | passed | public facilitator.x402.rs + on-chain Base Sepolia |
| Google Cloud Storage live bucket | passed | real GCS sandbox bucket round-trip |
| Grafana Cloud Mimir Alertmanager | passed | real Grafana Cloud sandbox tenant, HTTP 200 delivery |
| Solana SPL USDC dormant lane (canary proof) | dormant lane | on-chain Anchor verifier program FWdCDkFnex…vw9Z, canary tx 4N9XggyC…gQaY |
| Arc testnet billing settlement (primary rail) | operator-gated in alpha | Solana lane kept dormant: recipient ATA Hbzx5A9…s11A, USDC mint EPjFWdd5…Dt1v |
All four lanes pass against real third-party tenants , no operator-controlled compatibility stubs remain in the composition. The lane status above is what an operator reproduces when they run the verification sweep with their own credentials. The evidence pack ships in the dataroom on request.
What we do not claim
- We do not claim SOC 2, ISO 27001, HIPAA, or PCI certification.
- We do not claim official Okta, Entra, or Google SAML certification.
- We do not claim official SCIM 2.0 conformance certification.
- We are not enterprise GA. Private design-partner alpha only.
- Enterprise pilot has not started, the posture changes only when a real first signed pilot completes.
- No customer logos, names, revenue, or benchmark figures.
- No published price; no SLA program.