Trust & Security

Last updated: 6 August 2026

A venue is only as good as its integrity. This page describes the security posture of the Service in plain language.

Non-custodial by construction

Recourse never holds, transmits, or controls funds — on any rail. Rulings produce signed instructions; execution happens at the escrow provider, payment platform, or settlement rail the parties already use. There is no balance to steal and no key to lose, because we hold neither.

Credentials

Passwords are stored as salted scrypt hashes. API keys are shown once and stored only as SHA-256 hashes — we cannot recover a lost key, only issue a new one. Keys are revocable instantly from the dashboard. Google sign-in uses OpenID Connect with CSRF-protected state; we never see a Google password.

Webhooks and instructions

Every enforcement instruction is HMAC-SHA256 signed with a per-partner secret and timestamped against replay; receivers verify with constant-time comparison and dedupe on event id. The reference implementation ships in the integration kit.

Evidence handling

Dispute bundles are processed for adjudication and nothing else — content inside evidence is treated as evidence, never as instructions to the engine, and attempts to instruct the engine from inside a bundle are weighed as bad-faith conduct under the doctrine. Model inference runs on Anthropic's Claude API under its data-processing terms; bundles are not used to train models.

The venue's own accountability

Doctrine is published before disputes arise; every ruling carries its reasoning; error and overturn rates will publish as the corpus grows; and the fee model (never a share of the disputed value, never paid by disputants) removes the venue's stake in any outcome.

Reporting

Found a vulnerability? Report it here. We commit to acknowledging reports within 48 hours, and to never pursuing good-faith researchers.