Security
Routing is always subject to custody. Secrets never ride in traces.
Banana Peel is SOC 2 Type II. Vault credentials are encrypted with AES-256-GCM. Trust tiers and custody policies hard-filter which runners may ever see a secret. Run artifacts default to a 7-day retention window; enterprise can set custom retention.
Certified
SOC 2 Type II
Banana Peel's own report. Report available under NDA on request.
How a credentialed run moves
Client → API (TLS) → custody filter → vault decrypt → runner in the allowlist → redacted routing trace. Quality ranking never overrides custody.
01
Client
HTTPS to the Browser Agent API. Bearer or x-api-key.
02
Custody filter
Runner allowlist is applied before any secret is decrypted.
03
Vault decrypt
AES-256-GCM in-process, only after the policy is satisfiable.
04
Allowlisted runner
Injection onto a runner inside the policy — never the other way around.
05
Redacted trace
Passwords, TOTP, tokens, and card-like numbers stripped from routing traces.
What we store
Encrypted vault blobs
Username, password, optional TOTP — AES-256-GCM at rest.
API key hashes
SHA-256 of bp_live_… secrets. Prefix only in the console.
Run metadata
Routing, custody echo, cost, status. Customer task text as submitted.
Artifacts
Screenshots and downloads for the retention window (7 days default).
What we never store in the clear
Plaintext vault passwords
Decrypted in memory after custody; never returned by any endpoint.
TOTP seeds in responses
Write-only. Used in-process to answer OTP challenges.
Full API keys after create
Shown once. Stored as a hash.
Card numbers
Payments go through Stripe. We do not store PAN, CVC, or expiry.
If you paste a password into the task text instead of the vault, that string is stored as submitted input. Use credential_id.
Public hub: /security · Docs: /docs/security