> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vence.one/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Explainable decisions, versioned policy, scoped API keys, signed webhooks, and an honest security and model-governance roadmap.

# Security

## Decision integrity

* Every underwrite and access decision is **auditable** and **versioned**.
* Prefer deterministic policy for synchronous authorization paths.
* AI assists investigation — it does not silently replace human-governed policy.

## API hygiene

* Secret keys stay server-side (`sk_sandbox_…` / live prefixes as issued).
* Scopes limit what each key can read or write.
* Idempotency keys on mutating financial and decision writes.

## Webhooks

* HMAC-signed deliveries.
* Retry with backoff.
* Verify signatures before fulfilling.

## Controls boundary

Vence can pause product access, unused credit, and contractually permitted card controls. Docs never claim Vence freezes arbitrary external assets outside that scope.

## Console

Institutional login (WorkOS). Role-based membership. Environment isolation between sandbox and live.

## Security & model-governance roadmap

Honest status for founder-beta. **We do not claim SOC 2, regulatory licenses, or production compliance certifications today.**

### Available in sandbox (Decision Platform)

| Capability                                        | Status                          |
| ------------------------------------------------- | ------------------------------- |
| Scoped API keys + least-privilege scopes          | Available in sandbox            |
| WorkOS Console sign-in + role-based membership    | Available                       |
| Audit events / entity audit trail                 | Available in sandbox            |
| Decision replay (`GET /v1/decisions/{id}/replay`) | Available in sandbox            |
| Policy versioning + checksum integrity            | Available in sandbox            |
| Reason codes on every verdict                     | Available in sandbox            |
| Human review (`POST /v1/decisions/{id}/reviews`)  | Available in sandbox            |
| HMAC-signed webhooks                              | Available in sandbox            |
| Sandbox / live environment isolation              | Designed; live gated separately |

### Encryption & access control

| Control                                                        | Status                                                                                |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Encryption in transit (TLS)                                    | Planned for hosted API surfaces; required when public hosts are online                |
| Encryption at rest (provider secrets, webhook signing secrets) | In progress / available in codebase for sensitive provider tokens and webhook secrets |
| Broader datastore encryption-at-rest posture                   | Planned (depends on production database hosting)                                      |
| Scoped keys + WorkOS access control                            | Available (see above)                                                                 |

### Model governance

| Practice                                            | Status                                                                       |
| --------------------------------------------------- | ---------------------------------------------------------------------------- |
| Versioned models / policy versions on each decision | Available in sandbox                                                         |
| Human review path for overrides                     | Available in sandbox                                                         |
| Reason codes (explainability)                       | Available in sandbox                                                         |
| Adverse-action / adverse-notice direction           | Planned (program- and jurisdiction-dependent; not a claim of FCRA readiness) |
| Bias / fairness testing                             | Planned                                                                      |
| Retention schedules (documented)                    | Planned                                                                      |
| Published subprocessors list                        | Planned                                                                      |
| Incident response playbook (public)                 | Planned                                                                      |
| Independent penetration test                        | Planned                                                                      |
| SOC 2 Type I / II                                   | Roadmap — **not achieved; not claimed**                                      |

When evaluating Vence, treat sandbox controls as the verifiable baseline. Production enablement, certifications, and licensed program claims land only when evidence exists — not before.