On your device
Apple keys and the recovery private key use device-only Keychain when unlocked. They are excluded from iCloud cache and widgets. Recovery-key display and export require device authentication. Protect exported files yourself.
Explicit, separate authorization
Pro membership, report-key hosting, transaction connections and notifications are separate choices. The Admin key is never the hosted report key. The background report service restricts Apple requests to approved read-only routes.
Encryption with a clear boundary
Hosted report credentials use AES-256-GCM with separate service and user recovery envelopes. The authorized background service can decrypt the report key and fetched data; this is not a claim of end-to-end encryption that excludes the operator. The public API service does not hold that decryption secret.
Requests and Apple events
Device signatures, short-lived access tokens and replay checks protect cloud requests. Apple notification signatures are verified; transaction processing distinguishes Production from Sandbox. Account separation and encrypted records reduce exposure.
Revoke, delete, recover
Stop background authorization to halt future collection; remove the hosted key to delete both encrypted key copies. Delete the workspace to remove cloud data. Existing requests cannot be recalled. Keep your recovery key safe: the service cannot reconstruct it. No independent security audit or automatic key-rotation guarantee is claimed.