# Security

> Pagerless can undo your deploys, so it is built to be the safest thing in your stack: least access, loud failures and a record of everything.

URL: https://pagerless.dev/security
Updated: 2026-10-22

## Your app's data

- **Scrubbed twice.** The SDK removes secrets before anything leaves your server, and the server scrubs again before storing: API keys, bearer tokens and JWTs, key=value secrets, emails, phone numbers, card-like numbers (Luhn checked), long hex or base64 blobs and IP addresses. Query string values are dropped.
- **Kept briefly.** At most 5 error samples per problem, kept for 30 days.
- **Write-only ingest keys.** An ingest key can send events and nothing else. Only its SHA-256 hash is stored, and a revoked key stops working within 60 seconds.

## Credentials you give us

Twilio, Slack and host tokens are stored with envelope encryption: AES-256-GCM with a separate data key per account, wrapped by a master key. Each secret is bound to its own name, so ciphertext cannot be moved to another secret. The public API and the MCP server never read secrets back.

## Approvals

- Undoing a deploy, emailing customers and any data change need a passkey with user verification (Face ID, Touch ID or a security key).
- Each fix kind is set to alone, ask or never. Data changes are always never; irreversible kinds can be at most ask.
- AI agents connected over MCP can only propose fixes. Policy and a person decide.

## Audit log

Every action, by a person, the AI helper or an agent, is written to a hash-chained log: each entry's hash covers the previous one, so editing or reordering any entry breaks the chain. The log is exported to storage with a 365-day write-once lock.

## Sign-in

Passkeys, single-use email links that expire in 15 minutes, Google or GitHub.

## Where it runs

Pagerless runs on Cloudflare Workers with one isolated Durable Object per customer account. A separate watchdog sends a test alert through the whole pipeline every minute and pages the operator if it does not come back. Outgoing webhooks are signed with HMAC-SHA256 (`Pagerless-Signature`).

## The AI helper

Diagnosis uses Claude by Anthropic. Only scrubbed data is sent, it is not used for training, and error text is treated as untrusted data: instructions inside it are never followed.