> ## Documentation Index
> Fetch the complete documentation index at: https://docs.frostwolf.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> What is sent, what is stored, what is never sent, and who can see what.

## What the control plane sees

To inspect a payload, the SDK sends its text to `api.frostwolf.app` over TLS. That is inherent to server-side detection. In return, the control plane sends back a verdict and offsets, never a rule and never a pattern.

<CardGroup cols={2}>
  <Card title="Sent for detection" icon="arrow-up-from-bracket">
    The text of the payload, and any tool declarations and calls you submit.
  </Card>

  <Card title="Returned" icon="arrow-down-to-bracket">
    A verdict, the rules that fired, and offsets into your own text. For Cloak, entity
    types and ranges. Never a matched value unless you ask for evidence.
  </Card>
</CardGroup>

## What is stored

| Data | Stored? |
| - | - |
| Decision metrics (decision, severity, rule id, counts) | Yes, in your workspace, with telemetry on. |
| Payload text | **No**, unless you turn on capture. |
| Matched evidence | **No**, unless you turn on `includeEvidence`. |
| Request and response bodies | **No**, unless capture is on for the key. |
| Cloak values, tokens, and offsets | **Never.** Cloak telemetry is counts only, and anything else is discarded on receipt. |
| Cloak originals | Never sent to FrostWolf. They live in your vault. |

## Detection stays off the client

No signature, pattern, rule id list, or matching algorithm ships in an SDK. A rule set a client can read is a rule set an attacker can probe for a near miss. The same goes for Cloak: the SDK holds no recognisers, and is told where personal data is.

## Redaction stays on your side

The control plane returns offsets and the SDK rewrites your text. A payload is not sent to FrostWolf to be rewritten. Your message structure, images, and provider parameters are never touched by anything but your own process.

## Fail-safe defaults

| Situation | Behaviour |
| - | - |
| The control plane is unreachable | The request is refused, with a reason that says it was an outage. |
| A verdict fails validation | Treated like an outage. A partly understood verdict is never read as an allow. |
| Cloak could not check a payload | The request is refused with `cloak_unavailable`. |
| A response carries another identity's token | Refused with `RestoreDeniedError`, and reported as a count. |
| A credential or card verification code is detected | Redacted, never stored. |

## Keys

An API key authenticates detection, telemetry, and capture. Keep it server-side. Keys can be revoked in the console, and a key can only change its own capture setting.

## The Cloak vault

The default vault is process memory. It is bounded, it expires values after an hour, and a restart loses it. The SDK never encrypts what it stores. If you supply a persistent vault, encrypt it at rest and protect it as carefully as the data it holds. `forget` erases everything held for one identity.

## Reporting

Telemetry and capture are fire-and-forget. A reporting failure never reaches your request path.

To report a vulnerability, email [support@frostwolf.app](mailto:support@frostwolf.app).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.