Trust the receipt, understand the boundary.
How Elucora protects captures and what a valid receipt does—and does not—establish.
Effective and last updated: August 13, 2026Receipt integrity
New receipts use SHA-256 artifact and evidence hashes, RFC 8785 canonical JSON, and ES256 signatures. Each receipt includes a signing key ID. Current and retained public verification keys are published through JWKS.
Capture controls
The capture service accepts public HTTP(S) domain names on standard ports, rejects credentialed and IP-literal URLs, validates redirect destinations, caps response bytes, and applies a timeout. These are application-layer controls; network isolation provided by the hosting platform remains part of the SSRF defense.
Authentication boundary
Elucora’s browser account authentication relies on authenticated-user headers set by the OpenAI Sites dispatcher. The application is supported only when deployed through this sanctioned Sites project, where the dispatcher controls those headers. Direct Worker deployment, plain Wrangler deployment, or a reverse proxy that forwards client-supplied identity headers is unsupported and unsafe without a separate signed identity mechanism.
Transparency and independent time
Each accessed or newly issued receipt receives a public hash-chain entry that links its canonical payload hash to the preceding published entry. When a vetted Time Stamp Authority is configured, Elucora stores the RFC 3161 response after checking that its message imprint and nonce match. The token remains independently verifiable. A status of not_configured means Elucora still controls the clock; it must not be represented as independent time evidence.
What verification means
A valid signature means the receipt payload matches what Elucora signed with a trusted key. A valid independent timestamp additionally establishes that the transparency-entry digest existed no later than the authority’s signed time. Neither proves source truth, browser appearance, copyright permission, or legal sufficiency.
Report a vulnerability
Email support.citeseal@gmail.com with reproduction steps and impact. Do not access other users’ data, degrade service, or publicly disclose an unresolved issue. Security contact details are also available at /.well-known/security.txt.