Ownership & outputs
For bespoke work, the delivery path can manage source, documentation, and deliverables in KeyVault. Rights transfer and contract detail require a written agreement.
Trust instead of claims: what this platform actually does.
This page describes verifiable behavior in this Keylight build. It does not promise behavior outside the implementation.
Roles & access
Owner, Ops, and Editor have separate capabilities. Management sessions use PBKDF2 passwords, HttpOnly cookies, and a CSRF token for mutations.
KeyVault & handoff
Delivery files retain metadata and SHA-256. HMAC links have expiry, a download cap, and optional password protection.
Backup & recovery
An Owner can create a local backup bundle and, when configured, send it through a Telegram Bot connection. The connection token is not stored in SQLite or a backup bundle.
Deployment & observability
This build runs on the Python standard library with SQLite WAL and exposes a health endpoint. The uptime figure shown on site is not a substitute for contractual monitoring.
Privacy
Funnel analytics retain daily public-event counts only: no IP address, user agent, cookie identifier, form text, or commercial tracker. Data older than 90 days is removed.