Cloud, Vault & APIs · Defense-in-Depth · Full AI Markdown Manual (llms-full.txt) · OpenAPI 3.1 Spec
TRC Security, Isolation & Trust Architecture — Compute, Vaults, Media & Client Privacy
Built for security-conscious engineering teams and enterprise procurement: container-isolated AMD EPYC enclaves, per-service AES-256-GCM secret vaults, private encrypted off-site Backblaze B2 backups, 4-tier RBAC, LiveKit encrypted media, and 127.0.0.1 local client sovereignty.
- Secret Encryption: AES-256-GCM — Isolated per-service vaults + 1-click zero-downtime rotation
- Access Control: 4-Tier RBAC + 12 Scopes — Enclave Owner/Admin/Deployer/Viewer & SHA-256 API keys
- Off-Site Backups: 6-Hour Private B2 — Encrypted snapshots isolated from public release buckets
- Client Privacy: 127.0.0.1 + OS Keychain — macOS Keychain, Windows DPAPI & VS Code SecretStorage
Platform Defense-in-Depth Architecture
TRC unifies cloud hosting, object storage, AI inference, real-time communications, and desktop/IDE workstations under explicit cryptographic and network boundaries so a compromise or misconfiguration in one workflow cannot spill across tenants or devices.
| Security Domain | Protection Guarantee (What Protects Your Workload) | Customer Control Surface |
|---|---|---|
| Sovereign Cloud Compute & Databases | Dedicated AMD EPYC (US-East) Linux container isolation; PostgreSQL 16 + pgvector and Redis 7 bind strictly to internal loopback and private enclave DNS with zero public database ports; Caddy HTTP/3 + TLS 1.3 ingress | Manage topology, health probes, and instant immutable rollbacks in /cloud |
| Per-Service Secrets & Off-Site Backups | Environment variables encrypted at rest with per-service AES-256-GCM vaults; 6-hour encrypted database and state snapshots stored in isolated private Backblaze B2 buckets completely segregated from public release binaries | 1-click zero-downtime secret rotation & immutable audit trail in /cloud?section=security |
| Team Access & API Credentials | 4-tier Sovereign Cloud RBAC (Owner, Admin, Deployer, Viewer); API keys stored exclusively as irreversible SHA-256 hashes with 12 granular scopes and per-install key isolation | Mint, scope, and revoke keys per server or laptop in /developer/api |
| Financial & Webhook Integrity | Fail-closed HMAC signature verification across payment and carrier webhooks; pre-execution AI wallet reservations prevent negative-balance race conditions and enforce hard HTTP 402 spend caps | Set wallet balances, BYOK keys, and enclave spend caps per account |
| Custom Storefronts & Real-Time Media | Custom profile and storefront widgets run inside strict Content-Security-Policy (CSP) sandboxed iframes with origin-verified postMessage bridges and zero host cookie access; voice/video meetings run over encrypted LiveKit WebRTC transport | Inspect widget permissions at /developer/spec and room controls in TRC Meet |
| Singularity Desktop, Mobile & VS Code | Desktop local service binds strictly to 127.0.0.1 loopback with authenticated origin checks; secrets live in macOS Keychain, Windows DPAPI, or VS Code SecretStorage; session actions gated by Ask / Accept Edits / Allow All modes and workspace trust checks | Switch permission modes live per session and verify SHA-256 / SHA-512 installer hashes |
Data Ownership, AI Privacy & Zero Training on Private Workspaces
1. Zero Model Training on Private Data: Relationship Constitution, LLC does not train foundation models on your private local repositories, Sovereign Cloud databases, encrypted secret vaults, or private Cloud Storage Vault objects.
2. Local-First Workspace Sovereignty: On Singularity Desktop and the VS Code Extension, your source tree remains on your local disk. Only the specific prompt context or tool arguments required for an active turn traverse TLS 1.3 to your selected gateway model — or stay 100% offline on your own hardware when using local Ollama GPU models.
3. Cryptographic Release Provenance: Every Singularity Desktop, TRC Paint, VS Code Extension (.vsix), and Mobile package is served over HTTPS from durable Backblaze B2 storage with published SHA-256 / SHA-512 checksums in /claims-receipt.json and /docs/desktop.
Responsible Disclosure & RFC 9116 security.txt
TRC publishes a machine-readable RFC 9116 vulnerability disclosure manifest at https://www.trc.inc/.well-known/security.txt. Security researchers and enterprise compliance teams can verify active disclosure contact channels and policy scope directly from the root domain.
Verify security.txt & Release Hashes (cURL)
# 1. Inspect TRC's RFC 9116 vulnerability disclosure manifest
curl -fsSL https://www.trc.inc/.well-known/security.txt
# 2. Inspect the automated build-time claims & SHA-256/SHA-512 release receipt
curl -fsSL https://www.trc.inc/claims-receipt.json | head -c 1200Frequently Asked Questions
Are customer backups and snapshots ever stored in the same bucket as public downloads?
No. Public desktop, mobile, and VS Code installers are served from a dedicated public release bucket, while encrypted customer backups and enclave snapshots reside in strictly private, access-controlled Backblaze B2 storage.
Can another website or browser tab talk to my local Singularity Desktop service?
No. The Singularity Desktop local service binds strictly to 127.0.0.1 loopback and enforces strict Host/Origin validation plus per-install local session authentication, blocking cross-origin browser requests.
Does revoking one developer API key break my other servers or IDE installs?
No. Each server key and IDE installation uses an isolated SHA-256 credential record, so you can rotate or revoke a single compromised or retired device without disrupting production traffic elsewhere.