{"service":"AgentVault v1.0","encryption":"client-side AES-256-GCM","server_can_decrypt":false,"server_has_vault_key":false,"what_server_stores":{"encrypted_value":"AES-256-GCM ciphertext (unreadable without vault_key)","content_hash":"SHA-256 of plaintext (provided by client)","nonce":"encryption nonce (needed for decryption, not secret)","key_name":"visible (plaintext)","tags":"visible (plaintext)","size_bytes":"visible","timestamps":"visible"},"what_server_CANNOT_see":["memory content (plaintext)","vault_key (never transmitted to server)","what the data means or contains"],"integrity_verification":{"per_key":"SHA-256 content_hash","global":"Merkle tree root","anchored":"Merkle root in ActivityChain -> Bitcoin"},"data_portability":{"export":"GET /api/vault/export","no_lock_in":"Your data is yours. Server is blind storage."},"known_limitations":["Lost vault_key = unrecoverable data (by design)","Key names and tags are plaintext","No search on encrypted content","No server-side deduplication"],"quotas":{"free":{"max_keys":100,"max_blob_bytes":65536,"max_total_bytes":5242880,"max_ttl_days":365,"rate_write":30,"rate_read":120,"rate_list":30,"rate_export":2},"active":{"max_keys":500,"max_blob_bytes":262144,"max_total_bytes":26214400,"max_ttl_days":730,"rate_write":60,"rate_read":300,"rate_list":60,"rate_export":5},"bureau":{"max_keys":2000,"max_blob_bytes":1048576,"max_total_bytes":104857600,"max_ttl_days":null,"rate_write":120,"rate_read":600,"rate_list":120,"rate_export":10}}}