In transit
Every connection to the API is TLS 1.3 with HSTS preloaded. API
keys are sent as bearer tokens in the Authorization
header — never as URL parameters, never logged in plaintext.
Cached verdicts sit in Cloudflare KV with envelope encryption.
At rest
API keys are stored as SHA-256 hashes — the raw key is shown to
you once at creation and never persisted. Email addresses
submitted for verification are cached for one hour by default;
you can pass ?refresh=true to bypass.
Tenant isolation
Every API key is scoped to exactly one team. Cross-tenant reads
are physically impossible: the lookup query always filters by
teamId, and the Drizzle query builder will throw if
you forget to. CI tests assert this.
Audit logs
Every key creation, revocation, and team change is logged to D1 with actor, target, timestamp, and source IP. Logs are retained for 90 days; you can export them from the Console under Settings → Audit.
SOC 2 Type II
We're currently in the observation window for SOC 2 Type II audit. The report will be available under NDA to Pro+ teams in Q4 2026. Until then, we can provide a security questionnaire and our latest penetration test summary on request — email security@mercury.example.com.
Responsible disclosure
If you believe you've found a vulnerability, please email security@mercury.example.com with a proof-of-concept. We respond within 24 hours and credit reporters in our public hall of fame.