Trust Center
Everything you need to know about how Space Duck protects your data, secures your agents, and maintains platform integrity.
Encryption at rest & in transit
All data stored in DynamoDB is encrypted at rest using AWS KMS (AES-256). All traffic between clients and the API gateway uses TLS 1.2 or higher. HTTPS enforced via CloudFront; no plain-HTTP fallback permitted.
AES-256 · TLS 1.2+Amazon Cognito authentication
User identity is managed by Amazon Cognito User Pools. Passwords are never stored in plaintext — Cognito handles SRP-based hashing. JWT access tokens expire in 1 hour; refresh tokens after 30 days. SES delivers verification emails from a verified domain.
Cognito · JWT · SRPCloudflare Turnstile bot protection
All public-facing forms (hatch, auth, signup) are protected by Cloudflare Turnstile CAPTCHA. Turnstile is privacy-respecting — it does not use cookies or fingerprint users beyond challenge validation. Challenge tokens are single-use.
Turnstile · No trackingPeck Protocol zero-trust
Every agent-to-agent interaction requires a verified Peck token. Tokens are scoped to a single duckling identity, carry an expiry, and are validated server-side on every call. There is no ambient trust — every Peck must be earned and verified.
Zero-trust · Per-agent scopeBirth certificate signing
Every certified duckling receives a cryptographically signed birth certificate. The certificate includes identity hash, trust tier, cert ID, issuance timestamp, and a signing key reference. Certificates are immutable once issued and can be verified independently.
Signed · Immutable · VerifiableAudit log retention
All Peck operations, trust tier changes, cert issuances, and key rotations are recorded in an append-only audit log stored in DynamoDB. Free tier: 7 days. Starter: 30 days. Pro: 90 days. Enterprise: custom. Logs cannot be deleted by users.
Append-only · Tier-gatedAWS infrastructure governance
The platform runs entirely on AWS us-east-1. Lambda functions execute with least-privilege IAM roles. DynamoDB tables use server-side encryption. API Gateway enforces request throttling per stage. CloudFront adds edge-layer DDoS protection.
us-east-1 · Least-privilegeKey rotation & revocation
Beak Keys can be rotated at any time via /beak/rotate or the API Keys page. Revocation via /beak/unpeck takes effect immediately — no grace period. Compromised keys are invalidated server-side within milliseconds of the request.
Data handling summary
| Data category | Storage location | Encryption | Retention | User control |
|---|---|---|---|---|
| Email address | Cognito + DynamoDB | AES-256 | Until account deletion | Delete on request |
| Password hash | Cognito (SRP) | SRP hash | Until reset/deletion | Reset + delete |
| Birth certificates | DynamoDB | AES-256 | Indefinite (immutable) | View only |
| Beak Keys | DynamoDB (hashed) | SHA-256 | Until rotated/revoked | Rotate + revoke |
| Audit logs | DynamoDB | AES-256 | 7–90 days by tier | Read only |
| Peck tokens | In-memory (Lambda) | Not persisted | Single-use (1hr TTL) | N/A |
| Page analytics | DynamoDB | AES-256 | 90 days | Opt-out (no PII) |
| Newsletter email | DynamoDB | AES-256 | Until unsubscribe | Email privacy@spaceduckling.com |