Hosted on Railway + Supabase
API runs on Railway (Node.js/Express). Records stored in Supabase Postgres with row-level security. No cross-account data access is possible through the API. Self-hosting available under the MIT license for full infrastructure control.
Client-side hashing in every SDK. Customer-signed records.
The Python, JavaScript and MCP clients compute the payload hash on your machine and send it; the server recomputes independently and records a mismatch if the two disagree. The JavaScript SDK posts the payload and the server hashes it, so that path is server-computed. L3 commits are signed with customer Ed25519 keys before reaching our servers. Tampering with an L3 payload invalidates that signature, and checking it requires only your public key, not us. We could still drop or reorder records; what we cannot do is produce one you did not sign.
TLS in transit. Ownership checked on every read.
All API traffic is TLS 1.2+. Authentication uses Supabase JWT or agent API keys. Account isolation is enforced in application code: every route that takes a record id verifies ownership before returning anything, and a regression test fails the build if any such route stops doing so. The database holds row-level security policies, but queries run through a service role that bypasses them, so they are not what is protecting your data and we do not count them. API keys scope access to the owning agent only.
Honest about what we have, and don’t.
We do not hold SOC 2, ISO 27001, or HIPAA BAA at this time. Security questionnaires and current controls documentation available on request. For regulated deployments, the cryptographic verification model provides evidence of record integrity that does not depend on our certification status.
Plaintext by default. Encrypt it yourself if that is not acceptable.
Payloads are stored in plaintext by default, same as any cloud service. DarkMatter personnel with database access can read them. If that is unacceptable, encrypt the payload before you commit it: we hash and store whatever you send, so the chain is unaffected and only you can read the content. There is no server-side encryption feature, on any plan.
Report security issues directly.
If you discover a security issue, email [email protected] with subject “Security disclosure”. We respond within 48 hours and will credit responsible disclosures.
The verification model is open-source.
Download any proof bundle and run the offline verifier. No DarkMatter account. No internet. No trust in us.