Skip to main content

​
Security

Treeship is designed with a trust-minimized security model. You don’t need to trust us—you can verify everything independently.

​
Cryptographic Foundations

​
Ed25519 Signatures

All attestations are signed with Ed25519, a modern elliptic curve signature scheme:
  • Fast: ~70,000 signatures/second on modern hardware
  • Secure: 128-bit security level, no known practical attacks
  • Deterministic: Same inputs always produce the same signature
  • Widely supported: Available in every major language

​
SHA256 Hashing

Payloads and input data are hashed with SHA256:
  • Collision resistant: Computationally infeasible to find two inputs with the same hash
  • One-way: Cannot reverse a hash to get the original data
  • Deterministic: Same input always produces the same hash

​
Canonical JSON

Before signing, payloads are serialized to canonical JSON:
  • Keys sorted alphabetically
  • No whitespace
  • Consistent number formatting
This ensures the same logical payload always produces the same bytes to sign.

​
Trust Model

┌─────────────────────────────────────────────────────────────┐
│                    What you trust                           │
├─────────────────────────────────────────────────────────────┤
│  ✓ Ed25519 cryptography (open, audited, proven)            │
│  ✓ SHA256 hashing (industry standard)                       │
│  ✓ Your own verification (run it yourself)                  │
├─────────────────────────────────────────────────────────────┤
│                 What you DON'T need to trust                │
├─────────────────────────────────────────────────────────────┤
│  ✗ Treeship's servers (verify independently)               │
│  ✗ Treeship's database (signature proves authenticity)      │
│  ✗ Network integrity (signatures detect tampering)          │
└─────────────────────────────────────────────────────────────┘

​
Independent Verification

Anyone can verify any attestation without contacting Treeship:
  1. Fetch the public key once (or pin it in your code)
  2. Get the attestation (from us, from the agent, from anywhere)
  3. Verify locally using any Ed25519 library
If the signature verifies, the attestation is authentic—period.

​
API Key Security

​
Key Format

API keys use the format: ts_live_ + 32 random bytes (base64)
  • Prefix: Identifies key type and prevents accidental exposure in logs
  • Entropy: 256 bits of randomness (cryptographically secure)
  • Storage: Only the SHA256 hash is stored server-side

​
Best Practices

Environment Variables

Never hardcode keys. Use TREESHIP_API_KEY environment variable.

Key Rotation

Create new keys periodically. Revoke old ones immediately if compromised.

Separate Environments

Use different keys for dev, staging, and production.

Least Privilege

Don’t share keys between services that don’t need them.

​
If Your Key Is Compromised

  1. Revoke immediately: DELETE /v1/keys with the compromised key
  2. Generate new key: Request a new verification code
  3. Audit: Check recent attestations for unauthorized activity
  4. Update: Deploy new key to all services

​
Data Privacy

​
What We Store

DataStoredNotes
Action descriptionsYesYou control the content
Input hashesYesOnly the hash, not the data
TimestampsYesUTC, millisecond precision
MetadataYesOptional, you control content
SignaturesYesPublic, verifiable
API key hashesYesNot the actual keys
Email addressesYesFor key recovery only

​
What We Don’t Store

  • Your actual input data (only hashes)
  • Plaintext API keys
  • Agent source code or configurations
  • Any data you don’t explicitly send

​
Data Location

  • API hosted on Railway (US regions)
  • Database encrypted at rest
  • HTTPS required for all connections

​
Reporting Security Issues

Found a vulnerability? Email security@treeship.dev with:
  • Description of the issue
  • Steps to reproduce
  • Potential impact
We’ll respond within 48 hours and keep you updated on remediation.