Security and access
Separate service credentials, user sessions and verification keys.
#Credential responsibilities
| Material | Purpose |
|---|---|
| Service configuration / SDK credentials | Authorised service-to-product record delivery |
| Portal session and CSRF token | Authorised user actions |
| Seal, witness and report public keys | Signature verification |
One credential type does not grant the privileges of another. Keep private signing keys out of public documentation, example projects and application source repositories.
#Network and user permissions
Serve the institution portal over HTTPS. Validate institution and environment scope against the session. Restrict source connections to approved hosts and ports and use read-only accounts. Disconnecting a service from one application changes that application’s observation policy, not every other connection.
#Report a security issue
Contact info@sigillum.cloud with a concise description, affected version and synthetic reproduction steps. Do not include customer records, access keys or sensitive evidence in the initial email. Arrange an approved channel for detailed material.