Security & trust
Sill is the governance layer between an arriving AI agent and a merchant’s payment and inventory systems. The security properties below describe what the architecture guarantees, what anyone can verify themselves, and where the bounds are.
Sill holds no security certifications today and does not claim any. Where we describe properties of the architecture, we say so; where we describe what has been validated end-to-end, we bound the scope of that validation.
01Never custodies funds
The merchant’s existing payment processor — for example Stripe — holds the card, authorizes the charge, settles the transaction, and pays out to the merchant. Sill issues the signed authorization (the mandate) and the signed audit record that captures what happened. Sill never touches funds, never holds balances, and never moves money.
02Signed, end-to-end pipeline
The full path — signed mandate → policy evaluation → Stripe payment authorization → signed, Merkle-chained audit record — has been validated end-to-end on the live Stripe rail in production.
03Independently verifiable
Sill signs with ed25519. The public signing key is published at edge.sill.so/.well-known/jwks.json. Anyone can reproduce the signatures on a Sill agent card or ARD catalog using only published standards — RFC-8785 JCS canonicalization and ed25519 — with no access to Sill’s code.
04Tamper-evident audit
Audit records are append-only, signed with ed25519, and Merkle-chained so that any later modification breaks the chain. Records are exportable as a signed JSON bundle or a server-rendered HTML bundle for archival or external review.
05PCI-minimal architecture
Sill handles only opaque processor tokens issued by the merchant’s payment processor — for example, Stripe pm_* and tok_* identifiers. Raw payment card numbers never enter any Sill system. This boundary is enforced by the architecture and by a CI gate.
06Framework mappings
Sill maintains public, control-by-control mappings between its guardrails and the OWASP LLM Top 10, the OWASP Top 10 for Agentic Applications, MITRE ATLAS, and the NIST AI RMF. These are mappings, not certifications.
See the full control-by-control table at /standards.
07Sign-in
Dashboard access uses magic-link sign-in. There are no passwords to phish, reuse, or leak.
08Report a vulnerability
Report security issues to [email protected]. Include reproduction steps and the affected surface — edge endpoint, dashboard route, or audit format. Reports are read and acknowledged. Machine-readable contact details are published at /.well-known/security.txt per RFC 9116.
09For security reviewers
The material below is public. No NDA, sales call, or account is required to read any of it.
- Technical security referenceSigning, audit envelope, tenant isolation, key management.
- Compliance postureWhat Sill does and does not claim. Mappings, not certifications.
- Framework mappingsControl-by-control: OWASP LLM Top 10, OWASP Agentic Top 10, MITRE ATLAS, NIST AI RMF.
- Verify a signatureReproduce Sill’s ed25519 signatures with published standards and no Sill code.
- Subprocessor listThe service providers Sill uses and what data each handles.
- Data processing agreementSill’s standard DPA.
- Service statusLive status of the edge, API, and dashboard.
Verify the signatures yourself.
Install Discovery in about 90 seconds. The agent card and ARD catalog Sill emits for your site are signed with the public key at edge.sill.so/.well-known/jwks.json — no access to our code required.