@rubric-protocol/sdk 1.0.6 → 1.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -85,6 +85,27 @@ HTTP status codes: 202 = pending (retry), 200 = ready, 404 = not found
|
|
|
85
85
|
console.log("leafIndex:", proof.proof.leafIndex);
|
|
86
86
|
console.log("hcsSeqNum:", proof.hcsSeqNum ?? "pending");
|
|
87
87
|
|
|
88
|
+
## Payload Privacy — Storing Your payloadKey
|
|
89
|
+
|
|
90
|
+
Every tieredAttest response includes a payloadKey. This is the only time it is ever returned — Rubric does not store it.
|
|
91
|
+
|
|
92
|
+
You must store it. If it is lost, the encrypted payload is unrecoverable.
|
|
93
|
+
|
|
94
|
+
Recommended storage patterns:
|
|
95
|
+
|
|
96
|
+
- Secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) — index by attestationId
|
|
97
|
+
- Encrypted database column — store alongside your own record of the decision
|
|
98
|
+
- Customer-side KMS — if you operate your own key management system
|
|
99
|
+
|
|
100
|
+
Never log the payloadKey. Never transmit it over unencrypted channels. Never store it in the same system as the attestation record — the separation is what gives the privacy guarantee its strength.
|
|
101
|
+
|
|
102
|
+
The payloadCommitment (also in the response) is safe to store anywhere. It is a public binding between the key and the attestation, containing no secret information.
|
|
103
|
+
|
|
104
|
+
Example:
|
|
105
|
+
|
|
106
|
+
const result = await client.attestations.tieredAttest({ data: decision, sourceId: ' + chr(39) + 'my-system' + chr(39) + ' });
|
|
107
|
+
await mySecretsManager.store(' + chr(39) + 'rubric:key:' + chr(39) + ' + result.attestationId, result.payloadKey);
|
|
108
|
+
|
|
88
109
|
## EU AI Act Article 12 Compliance
|
|
89
110
|
|
|
90
111
|
Rubric satisfies the tamper-evident logging requirements of EU AI Act Article 12 for high-risk AI systems.
|