Skip to content
HumanChain

Security & privacy

This page covers HumanChain’s data-handling posture in v0.15. We keep it short and concrete because vague security pages mean nothing. If you want the formal compliance documents for an enterprise procurement review, write to the preview team.

What data we collect

Three categories. We describe each one in plain English.

1. Question and response text

When your agent calls consult():

  • The question text is sent to our Hub backend over TLS.
  • It’s stored in our Postgres cluster (Fly.io, US-East, encrypted at rest) for the duration of the call and, by default, for 90 days afterward for audit / dispute resolution.
  • It’s shown to the human(s) routed to the question. They see the raw text - we do not auto-redact PII inside question bodies. If your question contains PII, that’s your responsibility to redact before sending.
  • The expert’s response_text is stored alongside the question and follows the same retention.

After 90 days, the question/response pair is automatically purged from primary storage. A redacted, embeddings-only artifact is retained in HCKB (the Knowledge Base, v0.16+) for caching purposes - the raw text does not persist.

You can override retention to a shorter window from the dashboard; enterprise customers can negotiate retention down to 0 days (no storage after the call closes) under a custom contract.

2. Agent identity

Each API key is associated with:

  • An account (master or developer)
  • A chain (if you’re on a nominated chain)
  • Usage metadata (timestamps, credit consumption, latency)

We do not associate API keys with the end users of your agent. Your agent identifies as your agent; the user-on-the-other-end of your agent is invisible to us. If you want per-user attribution inside your account, that’s metadata you’d attach client-side - we don’t see it.

3. Expert identity and trust signals

For experts on our marketplace:

  • Identity-verified at signup (third-party KYC; we retain a hashed proof, not raw documents)
  • expertise grading scores per domain (publicly visible in their profile if they opt in; otherwise visible only to them and to routing)
  • Calibration battery answers (retained for re-verification on domain disputes)
  • Answer history (the questions they answered, retained for trust audit)

For nominated experts on a private chain:

  • Same as above, but visible only to the chain master and to other experts on the same chain. Not surfaced to the public marketplace.

What we never collect

To say it explicitly:

  • We don’t collect your end-user data (your customers, your users)
  • We don’t store payment information ourselves (Stripe holds it)
  • We don’t read or scan code your agent might pass us as context_brief (it’s stored alongside the question, treated as opaque text)
  • We don’t sell, license, or transfer question/response data to third parties for marketing, training, or analytics purposes

Encryption posture

  • In transit: Hub API traffic is HTTPS-only.
  • At rest (our application data): per-master integration credentials are encrypted with Fernet (AES-128-CBC + HMAC-SHA256).
  • At rest (the disk): HumanChain is hosted on Fly.io. Disk-level encryption of database volumes is provided by the platform, not by HumanChain — we attribute it rather than claim it as our own guarantee.
  • Secrets management: API keys are stored as SHA-256 hashes. Account passwords are hashed with bcrypt. The plaintext key is shown only once at issuance; you store it in your password manager.
  • Internal access: HumanChain employees can access raw question text only through audited admin tooling, only with a documented business justification (dispute resolution, abuse investigation). All admin access is logged and retained for 2 years.

Model-training stance

This is the question every privacy-aware developer asks first. The short version:

We do not train models on your question/response data.

Longer version:

  • The Groq Llama 3.3 70B LLM fallback is a hosted-inference call. Groq’s terms cover their handling. Our Hub does not retain response data beyond the documented 90-day window for the fallback responses specifically.
  • We do not fine-tune any model on aggregated user data without explicit opt-in from each affected account.
  • HCKB (v0.16+ Knowledge Base) caches embeddings of questions and text of responses, but only as a per-account scoped lookup table. Your HCKB cache is yours alone. Cross-account answer reuse never happens.
  • If you opt in to anonymous trust-signal contribution (off by default), aggregate expertise grading signals - not question text - may inform our trust model. This is rate-limit-style telemetry, not content.

If your compliance team needs a formal DPA, write to the preview team.

Question privacy in detail

Walking through the lifecycle:

  1. Agent calls consult() with a question. → Sent to Hub over TLS.
  2. Hub routes to humans based on domain tags. → Question text shown to the routed humans only.
  3. Humans respond. → Responses stored alongside the question.
  4. Agent gets the ConsultResponse. → Hub closes the call.
  5. 90 days later: raw text purged. Embeddings retained for HCKB cache (your account only).
  6. 2 years later: expertise grading trust metadata retained; admin access logs retained; raw text long gone.

You can shorten step 5 in the dashboard. You can negotiate step 6 under a custom contract.

Expertise grading and trust model

Expertise grading is HumanChain’s relative measure of demonstrated answer quality: an expert’s standing in a domain is a percentile among peers, never a published absolute score. We summarise the trust model here because it’s adjacent to security - bad answers have to have consequences for the system to be safe.

How grading works

Each expert is graded per domain on demonstrated answer quality, relative to peers: how they did on calibration, how their paid answers hold up to peer review, and whether they actually answer in that domain. The grading model itself is proprietary and not published here. Two principles are stable and worth stating:

  • Quality is earned per domain. Being strong in one field does not lift standing in another.
  • Bad answers have consequences. Answers that peers flag and review confirms as wrong, bluffed, or off-topic pull a standing down.

What can lower someone’s trust factor

  • A peer-flagged wrong answer that gets confirmed in adversarial review
  • A bluff: the expert claimed knowledge they didn’t have
  • Off-topic responses repeated over multiple queries
  • Slow / non-response over a sustained window
  • Reported abuse from query-asking accounts

What we do not score on

  • Personal characteristics
  • Demographics
  • Geography (beyond legal jurisdiction relevance for licensed domains)
  • Account age or “tenure on the platform”

Grading is a relative, percentile-based meritocracy of demonstrated answer quality, so no individual can game a fixed target. New experts can rise quickly if they answer well; long-tenured experts can lose rank if their quality drops.

Compliance

What we have today (each line is bound to the code that proves it — see the claims register; if we cannot prove it, it is not on this list):

  • HTTPS-only Hub API traffic
  • KYC on marketplace experts
  • API keys stored as SHA-256 hashes; account passwords hashed with bcrypt
  • Per-master integration credentials encrypted with Fernet (AES-128-CBC + HMAC-SHA256)
  • An append-only audit log of every admin action
  • Disk-level volume encryption provided by our platform (Fly.io), attributed to them rather than claimed by us

What we don’t have (not “yet” — today, we do not have these):

  • We do not hold SOC 2 certification.
  • We do not offer a HIPAA BAA.
  • ISO 27001 (later, on customer demand)
  • GDPR-compliant retention shortening (already possible per-account via dashboard; formal DPA pending)

If a specific compliance requirement is blocking you, the preview team is the fastest path. Don’t assume the answer is no.

Security incident response

If you discover a vulnerability or suspect a security issue:

  • Email the preview team (PGP key available on the dashboard)
  • We commit to a 24-hour first response on business days
  • We do not pursue legal action against good-faith security research; standard responsible-disclosure terms apply

For incidents affecting your account specifically (suspected key compromise, anomalous spending, etc.), the dashboard has a “rotate API key” button and a “freeze account” button. Use them first; email us second.

Next step

You’ve covered the operational pieces. To go back to the integration work:

Integration patterns → Make your first call →