Security & Privacy

VDM Nexus gives you cryptographic verifiability of what the model said, not cryptographic privacy of what you asked. Those are different properties. This page covers both — what we secure, what's private, and where the limits are.

Threat model

The signed-inference promise: given a receipt, a third party can verify that a specific LLM call happened with the parameters claimed. Three parties whose behavior we model:

What's secured today

• Identity: Ed25519 keypair, the same primitive Solana uses
• Replay prevention: unique tx_signature constraint on credits_ledger; nonces table on /inference
• Failure mode: route fails-closed if no facilitator is configured; no silent acceptance
• Transit: TLS everywhere
• Idempotency: repeating a paid call returns 409 payment_replay, not double-charge
• Receipt integrity: hashes bind content; on-chain tx proves payment; Ed25519 signature by the Nexus operator key proves Nexus issued the receipt. Fetch the public key at GET /api/v1/operator-key and verify with verifyReceipt from @vdm-nexus/x402.
• Rate limiting: Upstash-backed sliding window — 30 requests/minute per IP on /v1/chat/completions, 100 requests/minute per agent pubkey on both inference routes. 429 responses carry X-RateLimit-{Limit,Remaining,Reset} headers. Fails open with a one-shot warn log when Upstash env vars are absent. See Observability for the full event vocabulary.
• Facilitator signing in HSM: the Ed25519 fee-payer key lives in AWS KMS via KMS.Sign (algorithm ED25519_SHA_512). The private key never enters lambda memory. Derived address is asserted to match NEXUS_DEPOSIT_ADDRESS at startup; mismatch fails-closed. Live on Solana mainnet and devnet with the same code path. See Self-host the facilitator.

Mainnet hardening switches

Three operator-controlled env-vars bound real-USDC exposure on /v1/chat/completions. None require a code change or redeploy — flip in the Vercel dashboard and the next request reads the new value.

These are the incident-response surface. See Safe-mainnet switches for the recommended flip sequence and the structured log events each switch emits.

A SOL fee-payer balance probe runs on Vercel Cron every 5 minutes (/api/v1/ops/sol-balance) and emits sol_balance.low / .critical warn and error events when the wallet drops below 0.10 / 0.02 SOL. Pair with a log drain for push notifications.

What's NOT secured yet (and tracked)

• Independent security audit. ~2000 lines of TypeScript handling real USDC. Deferred until first revenue per founder decision (see roadmap). Roadmap item, Horizon 1.
• Per-region failover for the facilitator. Single AWS region today — a region outage stalls settlement. Multi-region KMS + fee-payer is a future hardening item. Roadmap item, Horizon 2.
• Operator economic security. Today the facilitator's behavior is on the operator's honor system. Future operator staking + slashing makes fraud expensive. Token-utility item, Horizon 3.

Privacy: what we store and don't store

What we keep in the database per call:

inference_logs:
  agent_pubkey       — the payer's pubkey (already public on-chain)
  upstream           — "openrouter"
  model              — e.g. "openai/gpt-4o-mini"
  prompt_tokens      — count, not content
  completion_tokens  — count, not content
  cost_usdc          — upstream's reported cost
  latency_ms         — server-side latency
  status             — success or error
  request_nonce      — tx signature (for idempotency)

What we do NOT keep:

• The prompt text itself
• The response text itself
• Any IP address or location data
• Any user-agent or device fingerprint

The receipt itself contains hashes of the prompt and response, not the content. The agent is the sole keeper of the actual prompt/response strings. If you lose them, you can no longer verify the receipt — that's by design.

Privacy: what's NOT private

Being honest about the limits:

1. Prompts go through the upstream provider unmasked. Today the model runs on OpenRouter's network, which routes to OpenAI/Anthropic/etc. They see the full content. Their logging and training policies are theirs. Until we add TEE / ZKML upstream providers, this is unavoidable.
2. Solana payments are public. Anyone watching the chain knows which wallets paid the Nexus deposit address, when, and how much. The content stays private; the usage pattern doesn't.
3. Agent pubkey is permanent. Once observed, all of that agent's Nexus calls are linkable under that pubkey. No mixing built in.

How to reason about this for your use case

The honest summary

Nexus today is strong on verifiability and integrity (hash-bound content, operator-signed receipts, on-chain settlement), decent on availability (self-hosted facilitator removes a third-party dependency), and explicitly not a privacy product for content sent to the model. If privacy of prompt content is the requirement, signed inference alone is the wrong tool — we'd need to add a private-inference upstream first, which is a Horizon 3+ roadmap item.

Reporting security issues

Please don't open public GitHub issues for security problems. Email dennis@vdmnexus.com with details. We'll respond within 48 hours.