▲HIGHLAND DOCS

Security and privacy

Keys

  • Keys are 256-bit random values. Only a peppered SHA-256 hash is stored; the key itself is shown once and cannot be recovered by anyone.
  • Passwords are stored only as PBKDF2-SHA256 hashes, 100,000 iterations, each with its own random 16-byte salt. Sessions use a __Host- cookie that is Secure, HttpOnly and SameSite, and only a hash of the session token is stored.

Encryption at rest

  • Personal data is encrypted with AES-256-GCM before it is written: account email addresses, contact form messages and affiliate payout details. Each value gets a fresh random IV, the column name is bound to the ciphertext, and values that belong to an account use that account's own key (derived with HKDF).
  • Values that must be looked up (your login email, coupon codes) are stored as a keyed HMAC-SHA256, never in plain text. A copy of the database alone reveals neither the addresses nor the codes.
  • The encryption key is a Cloudflare Worker secret, generated inside Cloudflare and never written to code, logs or the database. Without it the service refuses to store personal data rather than store it unencrypted.
  • Up to 20 keys per password account, each revocable on its own with DELETE /v1/keys/<prefix>.

Wallets

Payment addresses are not an account field. A browser wallet signs in the user's own extension. The Worker sees the transaction on Base after you submit the hash. See Wallets.

Your data

  • API inputs and outputs are not stored. The only row written per call is usage: account, API id, price and time.
  • Chat messages are PII-redacted before they reach the model, and neither messages nor replies are logged or stored.
  • Application logs carry an event name and counts only, with any text redacted: never keys, inputs, outputs or emails.
  • Outbound fetches (web, page, header APIs) refuse private, loopback and link-local addresses, so the APIs cannot be used to reach internal networks.

Payments

  • No custody. USDC goes straight from your wallet to a cold-storage address. The service holds no private keys and never moves your funds.
  • Top-ups are credited only after 3 confirmations, matched by a unique exact amount, and each transaction can credit once.
  • x402 payments are signed by your wallet for one exact amount, verified by a facilitator, and settled only after the API succeeded.
  • No card numbers are handled anywhere.

Transport and browser

  • HTTPS only.
  • This docs site sends a strict Content Security Policy (scripts and styles from this site only) and no tracking or third-party scripts.
  • Pay-per-call routes allow cross-origin calls from browser wallets without cookies; account routes do not.

Abuse limits

Key creation, sign-in, coupon redemption, top-up intents and the contact form are rate-limited. Inputs are validated against each API's JSON schema before anything is charged.

Report a vulnerability

Use the contact form with the subject Security. Please include steps to reproduce and do not access other people's data or degrade the service.