How errorcore handles your production data.

This page states what the system verifiably does. It claims no certifications and no service-level agreements; where a behavior has states, the console shows the state rather than hiding it.

Tenancy is organization-scoped on every request.

Console and API handlers derive the organization from the authenticated session and validate the selected project and environment against it. A caller-supplied organization identifier is never accepted, and probing a foreign or nonexistent resource returns the same answer.

Ingestion keys are server-side credentials, shown once.

API keys begin with ec_live_ and authenticate your servers to the ingest API. The plaintext is revealed exactly once at creation or rotation; only a keyed digest, prefix, and final four characters are stored. Rotation supports a bounded grace window and revocation is immediate.

The SDK encrypts payloads in-process.

The SDK encrypts each error package with AES-256-GCM before it leaves your process. Envelope integrity is verified with an outer HMAC before any decryption attempt. The ingest API stores the encrypted envelope bytes as received.

Server-side project-key material is KMS-wrapped for worker processing.

Project-key material is stored in KMS-wrapped form and unwrapped only inside the processing worker. Key rotation opens a bounded overlap window; retired keys stop verifying new envelopes. After the one-time issue flow, the console shows key IDs and states rather than plaintext key material.

Scrubbing is explicit and every gap names its reason.

Captured values carry one of five states, rendered exactly as stored:

• captured: the value as recorded at the throw site.
• redacted: matched the scrubbing policy; shown as the literal [redacted].
• truncated: the surviving prefix plus a truncation tag.
• missing: not captured, with the reason stated.
• derived: computed from other captured data, labeled as such.

Some fields are dropped before storage by design: environment-variable values, authorization and cookie headers, and values matching credential patterns. The dropped-field policy is documented in the security and PII docs.

Rate limits and plan caps are separate, honest signals.

A rate-limited request receives a retry signal and consumes no quota. A plan-limit rejection means the org-wide allowance is used up and says so; it is never disguised as throttling. Both appear in the admissions log with their own reasons.

Agent access is read-only and separately credentialed.

MCP access uses dedicated ec_mcp_ keys with explicit incidents:read and contexts:read scopes and optional expiry: a service-account mode for coding agents. The MCP server exposes read-only tools; ingest keys are never accepted there, and unknown or out-of-scope identifiers all return the same not-found answer.

A verified vulnerability-reporting route is still required.

Errorcore has not yet verified and published a private vulnerability-intake channel. Do not place suspected authentication, tenant-isolation, credential, cryptographic, payload, privacy, or data-integrity defects in a public issue or send customer payloads, credentials, or personal data to the intended support mailbox. Publishing a verified private route is a launch blocker.

Next step

Read the details, then send a controlled test error: the security docs cover the dropped-field policy and capture states in full, and you can start free to send a controlled test error through the pipeline.