> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curtly.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Scopes

> Data retention policy, transport encryption, and API key authorization scopes.

Curtly is designed with an in-memory execution architecture to prevent sensitive prompt text from being persisted.

***

## Data Lifecycle

* **Volatile Execution**: All compression logic runs in volatile server RAM.
* **Zero Disk Persistence**: Raw input prompts, extracted vault tokens, and compressed outputs are never written to disk, database tables, or persistent logs.
* **No Training Retention**: Prompts processed by the engine are never retained, indexed, or used for model training.

***

## Transport & Storage

* **TLS 1.3 Encryption**: All API endpoints enforce modern cryptographic cipher suites.
* **SHA-256 Hashing**: API keys are hashed with SHA-256 prior to database persistence. Raw secret keys cannot be extracted or reconstructed.

***

## API Key Lifecycle & Scopes

### Permission Scopes

<ParamField body="full" type="scope">
  Unrestricted access to the compression endpoint and account telemetry logs.
</ParamField>

<ParamField body="compress_only" type="scope">
  Restricted exclusively to `POST /api/v1/compress`. Cannot query usage logs or account billing state.
</ParamField>

<ParamField body="read_only" type="scope">
  Restricted to querying usage metrics and telemetry logs. Cannot execute prompt compressions.
</ParamField>

***

### Expiration Time-To-Live (TTL)

API keys can be configured with automated expiration windows:

* **30 Days**
* **90 Days**
* **1 Year**
* **Never Expire**

Requests using expired keys return `401 Unauthorized`.

***

### Immediate Revocation

Keys can be revoked at any time via the [API Keys tab](https://curtly.dev/dashboard?tab=keys). Revoked keys are rejected immediately across all active instances.