STELR runs inside your own AWS account. This page states what the product does, what it does not claim, and where to report a security issue.
Docs describe two KMS keys in your account: RSA 4096 for signing, with alias stelr/customer, and AES-256 for ledger encryption, with alias stelr-ledger/customer. Signing keys stay in your account. Only the public key is published to the registry, so third parties can verify without access to your account.
Each customer deploys a per-customer CloudFormation stack in their own AWS account and VPC. This page does not describe a shared multi-tenant service. Your content, signing keys, and provenance ledger stay in your account, subject only to the limited boundary crossings listed below.
Provenance records in your account are retained for 2,555 days under S3 Object Lock Compliance mode. Object Lock Compliance normally cannot be shortened. STELR cannot delete signed artifacts held under Object Lock in your account.
The registry publishes a public key and key identifier, which is cryptographic metadata only, never content. Verification uses that public key, not access to your internal systems.
Request bodies, including prompts, are never logged to CloudWatch. The docs state data_trace_enabled is false on all stages. The raw API key is never stored. The authorizer validates the SHA-256 hash of the key against your DynamoDB ledger.
What crosses the boundary to STELR is limited to a public verification key, billing metrics reported through AWS Marketplace, and, only if you opt in, a fixed set of content-free error telemetry fields such as error type, HTTP status, latency, and model ID, with no content, prompt text, or output ever included.
SOC 2 is in progress, not certified. GDPR and NYDFS 500.13 are described as designed to support, with scope not yet stated on this site. No other certification, audit, or control is claimed on this page.
Report a suspected security issue promptly to security@stelrai.com. Use that address only for security reports. General support goes to support@stelrai.com, as listed on the Support page. No response time, phone number, or address is promised on this page.
