Security

Mechanisms you can check, and claims we do not make.

Waymesh sits between your application and the providers that execute its work. This page describes how that position is constrained, names where each control lives in the repository, and is explicit about the difference between security architecture that exists and compliance certification that does not.

Implemented — security architecture

The controls below are in the codebase today. Each names the file or workflow that implements it, and most are covered by a test that fails if the behaviour regresses.

Not held — compliance certification

Waymesh holds no third-party attestation. Having controls is not the same as having been audited against a framework, and the two are not presented here as though they were.

Credentials

Two kinds of secret pass through the system: the API keys your applications use to reach Waymesh, and the provider keys Waymesh uses to reach execution providers. They are handled differently because the threat is different.

Waymesh API keys: Generated from 24 cryptographically random bytes and stored only as a SHA-256 hash alongside a short display preview. The raw key exists once, at creation. A database disclosure yields hashes, not usable keys.; lib/api-key-crypto.ts
Provider keys: Read from the worker's environment at execution time and used inside the adapter. They are never accepted from a caller, never persisted to the database, and never returned in any API response.; lib/providers/*-adapter.ts
Secrets in audit metadata: Audit events pass through a sanitiser that drops known secret field names and any value shaped like a credential, recursively. Metadata is written after that filter, not before.; lib/audit.ts

Request data

Where prompts and outputs live is the question most worth answering precisely, including the part that is not a selling point.

Job input and output are stored: A job's prompt and its result are persisted with the job record so you can inspect your own work. This is storage, plainly stated: it is not encrypted at the field level, and it is retained until the record is removed.; prisma/schema.prisma — Job.input, Job.output
They stay out of the evidence path: Routing evidence and reporting read provenance, numeric columns and status enums. Prompt text and model output have no path into that pipeline, which emits counts, rates and error statistics only.; lib/routing/intelligence/shadow-report.ts
Aggregate reporting carries no identifiers: Segments are keyed by provider and task type with tenants reduced to a count — enough to check whether a segment has enough observations, without the report becoming a list of who ran what.; lib/routing/intelligence/shadow-report.ts
Error logs carry identifiers, not payloads: Structured single-line JSON to stderr. Call sites pass job and attempt identifiers; prompts and outputs are not among the fields any call site supplies. The logger does not itself redact, so this is a discipline enforced at the call site rather than by the transport.; lib/log.ts

Isolation and policy

Constraints that must hold regardless of what any scoring function prefers.

Tenant isolation: Jobs, routing records, billing entries and API keys are scoped per tenant. A request for another tenant's resource answers not-found rather than forbidden, so the response does not confirm the resource exists.; tests/agent-jobs-tenancy.test.ts
Private execution is a gate: A workload whose policy forbids third-party execution is ruled ineligible for hosted routes before scoring begins. No score is high enough to place it on a public API.; lib/routing/intelligence/eligibility.ts
Self-hosted endpoints are classified: The Ollama adapter refuses a remote plaintext HTTP endpoint outright — sending prompts in the clear would contradict the private tier it exists to serve — unless explicitly overridden by an operator.; lib/providers/ollama-endpoint.ts, docs/privacy.md
Route protection: Application routes are gated by an explicit protected-prefix list; API routes authenticate individually by bearer token or session rather than relying on the proxy.; proxy.ts

Auditability

A control layer that cannot be checked afterwards is asking to be trusted, which is not the same as being trustworthy.

Decisions are recorded, not summarised: Each routing decision retains the candidates considered, the predicted cost and latency for each, and the specific constraint that excluded any rejected candidate.; lib/routing/intelligence/snapshot.ts
Predictions are kept beside outcomes: What was predicted before dispatch is stored with what actually happened, so a routing claim can be checked after the fact instead of taken on trust.; lib/routing/intelligence/shadow-report.ts
Execution is pinned to the scored route: The selected endpoint, model and pricing version are pinned and re-verified before execution. If the pinned price can no longer be proven, the attempt is not silently charged at a different rate.; lib/jobs/worker.ts

Billing integrity

Spend is the part of an infrastructure layer where a rounding decision becomes a customer dispute.

Exact integer money: All monetary values are integer micro-USD. Integers were chosen over floating point so ledger arithmetic is exact and no rounding drift accumulates across thousands of entries.; lib/billing/ledger.ts
Reserve, then settle: Budget is reserved before execution and captured after it, with the reservation released on any terminal outcome. A partial failure cannot leave a charge without a corresponding execution.; lib/billing/ledger.ts
Idempotent by construction: Every ledger operation is keyed uniquely, so a retry cannot double-charge. Settlement integrity is asserted per job rather than per attempt.; lib/billing/settlement-integrity.ts

Supply chain and deployment

Controls that run on every change, not on a schedule someone has to remember.

Secret scanning: Gitleaks runs on every pull request. The allowlist covers three deliberate fake-credential fixtures whose entire purpose is to be stripped by the code under test, and each is documented by file and line.; .github/workflows/ci.yml, .gitleaks.toml
Dependency audit: High and critical advisories in production dependencies are a hard gate — the build fails. The full tree is audited advisory-only, because the remaining findings are dev tooling that never ships.; .github/workflows/ci.yml
Dependency updates: Dependabot opens weekly npm and GitHub Actions upgrade pull requests. Every bump goes through review; nothing merges itself.; .github/dependabot.yml
Branch protection: Four checks are required before merge — validate/test/build, Postgres integration, end-to-end, secret scan — and every review conversation must be resolved. Enforced as a repository ruleset, verified by a test.; docs/branch-protection.md, tests/branch-protection-ruleset.test.ts
Migration preflight: A read-only preflight reports whether pending migrations can apply cleanly before they are attempted. It prints aggregate counts only — never prompts, outputs, identities or credentials — and repairs nothing.; scripts/migration-preflight.ts
Deployment verification: The post-deploy report serialises presence booleans and derived status strings. Connection strings, session secrets and API key values are asserted absent from it by test.; docs/deployment-verification.md, tests/deployment-verification.test.ts
Transport and browser headers: A strict Content-Security-Policy restricted to same-origin, plus HSTS with preload, frame-ancestors none, nosniff, a constrained Referrer-Policy and a Permissions-Policy denying camera, microphone and geolocation.; next.config.mjs

What we do not claim

Stated plainly because it is the first thing a security reviewer verifies, and a badge nobody earned does not survive that check.

Waymesh holds none of the following, and does not represent itself as certified, compliant or audited under any of them:

SOC 2 (Type I or Type II)
ISO/IEC 27001
HIPAA
PCI DSS
GDPR certification under Article 42

No penetration test report or independent security audit is published today. Waymesh is also independent of the providers it routes to, with no partnership, endorsement or reseller relationship with any of them.

Running a security review? Shadow mode makes the assessment concrete rather than hypothetical — it decides and records without controlling any real execution.

Apply for Design Partner Access