Current controls
Organisation endpoints require the hosting platform’s ChatGPT identity. Reads and actions check the organisation owner; state-changing browser requests must match the site origin. This depends on the trusted hosting identity boundary.
Domain verification requires an exact DNS TXT challenge before its expiry. Stripe webhook processing verifies a signature, rejects live events and checks organisation associations before recording supported receipts.
What is not established
There is no production device admission, endpoint scanner, member directory or AI-resource lockout. Demonstration reports do not establish the state of any real device. These pages do not assert an external security audit or certification.
The proposed 24-hour lifetime applies to shared configuration recipes. It is not a retention policy, a guaranteed refresh interval or proof that offline devices are secure.
Health information
Do not submit patient information or ePHI to this preview. No HIPAA-supported deployment or executed BAA is offered. A future supported use needs an applicability assessment, safeguards and appropriate agreements with relevant providers.
Encryption alone does not remove business-associate obligations when a provider creates, receives, maintains or transmits ePHI on a regulated customer’s behalf.
Before production
Verify provider contracts, deployment permissions, data locations, incident procedures, recovery, retention and deletion. Publish a monitored security contact and support process. Do not send secrets to an unverified address.
Official references
These sources inform the draft. They do not endorse Alethrai.