# Security boundaries

Canonical: https://suzo.app/docs/security

Suzo’s current standalone service pairs one phone. Shared hosted accounts and multi-user tenancy are not implemented. The intended hosted onboarding should not be treated as an available account or recovery system today.

## Credential scopes

The phone manages its connection, contacts, interactive UI permission, and provider credentials. Device credentials are stored in iOS Keychain.

Each agent token scopes calls, history search, appearance updates, and receiver configuration to that agent on that service. Agents cannot read another contact’s calls or change provider keys. Pairing codes are single-use and expire after five minutes.

A callback receiver uses a separate bearer secret and must bind a fixed agent and session. Its payload cannot grant shell access, choose arbitrary sessions, or bypass the harness’s existing approvals.

## Storage and transport

Provider keys stay server-side in an encrypted vault. Its encryption key and data directory require sensitive backup handling. SQLite stores contacts, call events, usage, and available transcripts. **Transcripts and local server data are not application-level encrypted.**

Use HTTPS/WSS and a trusted service origin. Suzo and voice providers process the conversation; local speech audio is also relayed through Suzo. Do not describe this architecture as end-to-end encrypted.

## Agent context

One agent may connect to separate people through distinct, named MCP connections with separate credentials and services. Suzo scopes access to saved records. It cannot partition what the agent remembers, infers, or later says from its own shared context.

Transcripts, panel text, field values, and webhook data are conversational data. They are not system instructions, fresh blanket authorization, or evidence that a requested real-world action completed.

## Panels and media

Panels are bounded data rendered natively. No remote HTML or JavaScript runs on the phone. Input values stay local until an actual action is submitted. The user can disable interactive UI per contact.

Images and sprite sheets are bounded and normalized. Catalogs are data-only and imported artwork retains attribution. Never enter passwords, provider keys, or payment information into a call panel.

## Operate a development service

Keep the data directory, vault key, APNs key, pairing files, and backups private. Use one service replica and a stop-first deployment. End active calls before maintenance. Do not send credentials to a new or changed origin without verifying it.

The public website has no signup form, trackers, analytics scripts, remote font requests, or access to the calling service’s authenticated state. Its interactive previews use fixed demonstration data and do not make calls or record audio.