Secret key — server only
stl_sk_… ingests, reads, exports, and mints feed tokens for one project. Lives in your server environment; shown once at creation, stored hashed, revoked instantly on delete.
Security
Your customers' history, guarded like it matters.
Softechlog stores security-relevant data about your users, so our security model has to be legible. This page states what's in place today — plainly, without vanity claims — and what we don't claim yet.
The model
Least privilege, by construction.
Three credentials, each with exactly the power it needs — so the blast radius of any exposed credential is small and known in advance.
Public key — ingest only
stl_pk_… can submit auto-capture events and nothing else — every read attempt returns 403. Embedding it in a page can never expose other users' activity.
Feed token — one user, short-lived
stl_ft_… is minted by your server, pinned to a single actor, read-only, and expires (60 s – 24 h). It's the only credential a customer's browser ever holds.
Controls
What's enforced automatically.
Project isolation
Every event, actor, and session is scoped to one project at the database level. Each credential resolves to exactly one project; there is no cross-project read path.
Append-only history
No API exists to edit or selectively delete events — corrections are new events. That structural property is what makes the trail usable as audit evidence.
Automatic retention
Retention is set by plan (30/90/365 days) and enforced hourly by a scheduled purge — a stated policy executed by a machine, not by intention.
Encrypted transport
All traffic is HTTPS/TLS. SMTP and internal service connections verify certificates; strict security headers are set on every response.
Rate limiting
Redis-backed sliding-window limits on every public path — per secret key, per public key, and per source IP on unauthenticated endpoints — with fail-safe defaults.
Instant revocation
Deleting a key revokes it on the next request. Keys are stored hashed; plaintext is never persisted. Feed tokens expire on their own within 24 hours at most.
Honesty section
What we don't claim (yet).
We're an early-stage product, and we'd rather you know exactly where we stand:
- No SOC 2 report of our own yet. We provide the logging controls your audit needs; our own certification is on the roadmap, not in hand. Ask us and we'll share our current practices in detail.
- Single-region managed infrastructure. If you have hard data-residency requirements, talk to us before integrating.
- Your metadata is your responsibility. We cap and store what you send; don't put secrets or unnecessary PII in event metadata.
The full technical detail — CORS policy, key lifecycle, credential scoping, and what to verify before production — is in the security documentation. Found a vulnerability? Email hello@softechlog.com and we'll respond fast.
Evaluating for a security-sensitive rollout? We'll walk through the architecture with you.
Schedule Technical Call