Security & Scopes

Curtly is designed with an in-memory execution architecture to prevent sensitive prompt text from being persisted.

Data Lifecycle

Volatile Execution: All compression logic runs in volatile server RAM.
Zero Disk Persistence: Raw input prompts, extracted vault tokens, and compressed outputs are never written to disk, database tables, or persistent logs.
No Training Retention: Prompts processed by the engine are never retained, indexed, or used for model training.

TLS 1.3 Encryption: All API endpoints enforce modern cryptographic cipher suites.
SHA-256 Hashing: API keys are hashed with SHA-256 prior to database persistence. Raw secret keys cannot be extracted or reconstructed.

scope

Unrestricted access to the compression endpoint and account telemetry logs.

scope

Restricted exclusively to POST /api/v1/compress. Cannot query usage logs or account billing state.

scope

Restricted to querying usage metrics and telemetry logs. Cannot execute prompt compressions.

API keys can be configured with automated expiration windows:

Requests using expired keys return 401 Unauthorized.

Keys can be revoked at any time via the API Keys tab. Revoked keys are rejected immediately across all active instances.