Third-party proxy
Agents call FlockTab. FlockTab calls the provider. We see the provider key in RAM for that hop only. Ciphertext at rest cannot be decrypted without your unlock secret. Keys do not stay in your VPC on SaaS v1.
Security
Third-party proxy. Documented, not hidden.
We sit in front of spend. Caps, risk, and the ledger run here, not in the agent. Ciphertext at rest; unlock is on the request. This is the public threat model, not a compliance brochure.
Provider keys
AES-256-GCM ciphertext at rest. Unlock secret is never stored. Decrypt only in the proxy, only for the upstream call. Raw keys are not logged.
Virtual keys
ft_live_ and ft_test_. SHA-256 hash at rest. Secret shown once at issue. Revoke is instant: every request checks revoked_at.
Fail closed
The ledger is integer cents in Postgres. If Postgres is down, the proxy returns 503 and does not call the provider.
Audit
Each row is agent, tool, cents, allow or deny. Prompt and completion bodies are not stored by default.
Kill switch
Close the tab. New reserves stop. A stolen virtual key's blast radius is the remaining cap on that tab.
Irreversible tools
Payments, email send, delete, prod deploy default deny unless allowlisted and remaining ≥ $25.00. Unknown tools are write, not read.
In-flight retry
Retry the same request against an open hold: 503 ledger_unavailable. No second upstream call against one hold.
Not yet
No SOC2, no VPC, no customer-managed keys, no prompt redaction suite, no live Stripe checkout, no prepaid wallets. Do not infer them.