> ## Documentation Index
> Fetch the complete documentation index at: https://docs.archal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data handling and security

> Protect control-plane keys, scoped provider credentials, and synthetic state.

## Separate control and data credentials

The workspace key can create, inspect, reset, renew, and destroy sandboxes
within its scopes. Keep it in trusted control code.

Each ready environment receives a different short-lived provider credential.
Give the application under test only the returned `credentials.headers` map.
The data plane rejects workspace keys and credentials scoped to another
sandbox or environment.

Never send a production provider credential to Archal.

## Use synthetic state

If a test needs production-derived structure:

1. minimize fields
2. remove secrets and personal data
3. replace stable identifiers
4. document source and retention
5. validate the sanitized artifact before upload

Supabase SQL has an additional statement safety boundary. Customers still own
the content and legality of every fixture.

## Keep authority away from the agent under test

An untrusted agent should not receive Archal lifecycle or state-management
authority. Give it only the provider tools and credentials required for the
task. A trusted coding agent can manage the surrounding lifecycle while state
replacement and reset remain approval-gated.

## Isolation and cleanup

Sandbox ownership is checked for every lifecycle request. Scoped credentials
bind provider calls to one sandbox and one environment. TTL cleanup, teardown
retry, and orphan reconciliation are backstops when a caller disappears.

Destroy is still the normal completion path. Keep raw session responses out of
logs because they contain scoped provider credentials.

## Evidence and retention

The current evidence endpoint returns bounded metadata, counts, retention
status, and an integrity hash. It does not provide raw request, response, or
state export.

Availability targets, audit exports, reserved capacity, custom retention, and
compliance commitments apply only when implemented and included in a signed
agreement.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.