# Security and access

Separate service credentials, user sessions and verification keys.

## Credential responsibilities

| Material | Purpose |
|---|---|
| Service configuration / SDK credentials | Authorised service-to-product record delivery |
| Portal session and CSRF token | Authorised user actions |
| Seal, witness and report public keys | Signature verification |

One credential type does not grant the privileges of another. Keep private signing keys out of public documentation, example projects and application source repositories.

## Network and user permissions

Serve the institution portal over HTTPS. Validate institution and environment scope against the session. Restrict source connections to approved hosts and ports and use read-only accounts. Disconnecting a service from one application changes that application’s observation policy, not every other connection.

## Report a security issue

Contact **info@sigillum.cloud** with a concise description, affected version and synthetic reproduction steps. Do not include customer records, access keys or sensitive evidence in the initial email. Arrange an approved channel for detailed material.