# Security, compliance, and observability

Two simple rules: no AI agent has access to funds, and everything Vivra does can be publicly verified.

## Keys and wallets

- Hot wallets (Buyback Bot, AI): keys in a secrets vault, never in code, logs, or agent context. Maximum balances are defined and monitored.
- API keys (Surplus, X, Telegram, hosting, email) rotate every 90 days. Voter email addresses are stored encrypted and never exposed by the API.

## Contracts

- One V1 contract: BuybackBurner. Small, non-upgradeable, with hard-coded caps.
- Unit tests and Robinhood Chain mainnet-fork tests before deployment.
- Contract source published and verified on the explorer.

## Agents

- Inputs from X, Telegram, and third-party sites are treated as untrusted data (section 6).
- Closed tool list per agent, capped budgets, emergency stop.

## Compliance

- No promised returns anywhere: dapp, landing page, agent posts, or CTO token accounts.
- Risk notices on every page and in the X bio.
- Published rule: the team holds no candidate tokens, before or after the vote.
- Automated X accounts are labeled as such.

## Observability and alerts

| Alert | Threshold |
| --- | --- |
| Tracking delay for an active CTO token | more than 5 minutes |
| Hot wallet balance | above the maximum or below the planned minimum |
| Failed Buyback Bot transaction | any failure |
| Agent budget | 80% reached, then 100% |
| Late operation step | more than 1 h behind schedule |
| Surplus balance | less than 7 days of usage |

Alerts go to a private team Telegram channel, alongside a dashboard of active operations.

## Acceptance criteria

- [ ] No private key or API key in the repository, logs, or prompts (automated scan).
- [ ] Every alert in the table tested once under realistic testnet conditions.