Security

Statero is built for developers who send usage events from backend systems. Security is designed around least privilege, encryption in transit, and hashed credentials at rest.

Console access uses Clerk with industry-standard session management. Multi-factor authentication is available through your Clerk account settings. We do not store passwords directly.

• Keys are generated with high entropy (apm_ prefix)
• Only a SHA-256 hash and display prefix are stored; full keys cannot be retrieved
• Keys are shown once at creation; rotate by creating a new app if compromised
• All API traffic must use HTTPS (https://api.statero.app)

• API and console hosted on hardened cloud infrastructure in the EU
• PostgreSQL for project metadata and metrics with access restricted to production services
• Regular OS and dependency updates; secrets managed outside source code
• Automated backups for operational recovery

Usage events contain identifiers and token counts you choose to send, not LLM prompts or responses unless you explicitly include them in optional fields. See the Privacy Policy for retention details.

We investigate security reports promptly. If we confirm a breach affecting customer data, we will notify affected account holders without undue delay as required by applicable law.

Email support@statero.app with details. Please do not test against production accounts you do not own.