Security and data handling
Security and data handling in Halvr.
Halvr handles provider credentials and may process sensitive requests. It defaults to metadata-only retention, encrypts stored secrets, validates outbound endpoints, and records administrative and spend decisions.
Summary
Halvr encrypts stored provider credentials with AES-256-GCM, defaults request retention to metadata only, validates custom endpoints and webhooks against private-network targets, disables automatic upstream redirects, signs outbound webhooks, and maintains hash-linked project audit events. Halvr describes its logs as SOC 2-ready; it does not claim SOC 2 certification.
Credential encryption
AES-256-GCM
Default retention
Metadata only
Outbound targets
Public HTTPS in production
Credential storage
Provider and webhook secrets are encrypted before database persistence using AES-256-GCM with a random 96-bit initialization vector and an authentication tag. The application derives the encryption key from a server-only production secret.
Credentials are decrypted only in server-side provider routing and are never returned to dashboard clients after storage. Rotation replaces the encrypted value without exposing the previous key.
Request retention
No. Metadata-only mode stores routing, usage, cost, latency, attribution, and policy evidence without prompt or response content. Redacted mode retains payloads after masking common secret fields. Full mode is available for teams that explicitly need request-level debugging evidence.
Projects can bound retained request history to 7, 30, or 90 days and can trigger a purge from settings. Raw usage and audit archives should be governed separately according to the customer's operational and contractual requirements.
Custom endpoints and webhooks
Production outbound URLs must use HTTPS, contain no embedded credentials, resolve to public addresses, and avoid loopback, link-local, private, carrier-grade NAT, multicast, and reserved network ranges. Slack webhooks are further restricted to official Slack hook hosts and service paths.
Provider fetches use manual redirect handling so an accepted public endpoint cannot silently redirect the proxy into an unvalidated private destination.
Audit records
Project administrative events are canonicalized and linked with previous-event hashes. Signed exports include event counts, sequence boundaries, a root hash, and a manifest hash so an exported chain can be checked independently for missing or modified records.
Usage events use deterministic deduplication keys across Postgres, ClickHouse, and R2 sinks. This is delivery integrity for operational evidence, not a claim that every storage system is an immutable legal ledger.
Current boundaries
Halvr does not claim SOC 2 certification, zero-knowledge encryption, or customer-managed KMS envelope keys in the current product. The product provides SOC 2-ready logs and practical controls that can support a customer's evidence program.
Security reports can be sent to hello@halvr.io. Reports should include the affected URL or component, reproducible steps, impact, and a safe contact method without including live provider credentials.
Try Halvr
Route a real request through Halvr.
Keep your current SDK. Change the base URL, attach customer and feature metadata, and set a spend limit.