1. Overview & Zero-Persistence Architecture
ShunopsAI is engineered with a strict Zero-Persistence Architecture. We adhere to the fundamental invariant that user-supplied third-party API credentials (including BYOK keys for Groq, Google AI Studio Gemini, GitHub Personal Access Tokens, and Hugging Face User Access Tokens) must never be stored in our persistent database tables, written to server file systems, or retained in persistent application state.
2. Client-Side Cryptographic Vault (W3C WebCrypto API)
When users elect to store their API credentials for browser convenience, ShunopsAI utilizes client-side, hardware-backed isolation:
- Algorithm: AES-256-GCM (Galois/Counter Mode with 128-bit authentication tags).
- Key Generation: Master symmetric keys are generated via crypto.subtle.generateKey with extractable: false. The raw secret key bytes cannot be read by page scripts, browser extensions, or malicious AST injectors.
- Storage Sandbox: Encrypted initialization vectors (IVs) and ciphertext are persisted solely within the browser's origin-scoped IndexedDB (shunops_secure_vault_v3). No unencrypted payload ever touches server disk.
- Ephemeral Transit: During live inference requests, keys are transmitted via TLS 1.3 encrypted headers (x-groq-key, x-gemini-key). They are consumed in volatile server memory solely for the lifespan of that specific HTTP request and immediately garbage-collected.
3. Distributed Rate Limiting & Subnet Data Handling
To prevent denial-of-service bursts while maintaining anonymity:
- Subnet Level Aggregation: Rate limits are calculated at the /24 IPv4 subnet or /48 IPv6 subnet boundary rather than individual persistent user tracking.
- Edge IP Resolution: Client IP resolution strictly reads the trusted edge proxy hop (CF-Connecting-IP or the terminal hop appended by Cloud Run reverse proxies) to prevent header spoofing attacks.
- Distributed Redis Cache: Counters are stored ephemerally in high-speed Redis instances hosted on Oracle Cloud Infrastructure (OCI) with automatic sliding expiration (TTL).
4. Account Data & Session Management
For registered user accounts:
- Password Hashing: Passwords are cryptographically salted and hashed using bcrypt with adaptive work factor 10.
- Hashed Session Tokens: Session cookies (shunops_user_session) are stored in PostgreSQL database tables exclusively as cryptographic SHA-256 hashes. A read-only database snapshot leak cannot grant active session hijacking.
- Cookie Flags: Session cookies enforce HttpOnly, SameSite=Lax, and Secure in production environments.
- One-Time Passwords (OTP): Email authentication codes are single-use tokens that expire immediately upon first verification or after 5 minutes. No grace periods or replay windows are permitted.
5. Third-Party Model Providers & Egress
Inference requests cascade across authorized foundation model providers:
- Google AI Studio / Gemini API: Generative Language REST endpoints (generativelanguage.googleapis.com).
- Groq LPUs: Tensor streaming execution (api.groq.com/openai/v1).
- OpenRouter: High-parameter reasoning router (openrouter.ai/api/v1).
- Cloudflare Workers AI: Edge LoRA adapter inference via Cloudflare global network.
No prompts or code snippets processed through ShunopsAI are used to train proprietary base models.