provider keys
What happens to a key you paste in
Paste a provider key into the settings and AES-256-GCM encrypts it before anything is written down. What is stored is a 12-byte nonce, an authentication tag and the ciphertext. The settings screen shows the last four characters.
On your own key the request goes to Anthropic, OpenAI, DeepSeek or Gemini. Your provider bills that work, and Corlecti Map charges you nothing for it, on every plan. Search by meaning sends every block's title and text to OpenAI's text-embedding-3-small, always on Corlecti Map's key.
A sticky note on the monitor is not in the threat model.
refusals
Each of these routes has a ceiling of its own
Go past one and the answer is a 429 with the seconds to wait, never a captcha. Claude Code over MCP and a Telegram webhook cannot pass a captcha.
Web traffic reaches the server only through Cloudflare's published ranges, and that list refreshes weekly. A refresh that comes back short or empty overwrites nothing, so it cannot widen the ranges. It cannot empty them either.
privacy
Until you share it,
the map is not there
To anyone else your map simply does not exist: a request gets "not found", never "no access". Otherwise "no access" would tell them the map is there.
Publishing a map is a thing you do on purpose, and it is the only thing that changes that answer.
export
Everything leaves in one file
One .mmap file, Corlecti Map's own format, carries the whole map: every block, every connection, the layout.
It comes out on every plan, at any hour of any day.
There is nothing to request and nobody to ask.
one account
No second account to lose
Corlecti Map has no sign-up of its own.
One Corlecti ID signs you in here and into every other Corlecti product.
So Corlecti Map holds no password of yours, and signing in happens at Corlecti ID.
backups
The restore was rehearsed on 2026-09-09
A dump of the whole database runs every night at 02:00. It travels to a second server over a key that can do nothing but receive it. 30 days are kept.
On 2026-09-09 one dump went back onto a throwaway container and was read by hand. 19 maps, 715 blocks, 769 connections, up in 2 seconds. The container was destroyed after the check.
Those 2 seconds are a starting point for a bigger database, never a promise about one.
A backup that has never been restored is a hypothesis.
audits
Every pass, named and dated
Three internal passes since 2026-08-15, each one a dated document.
The first covered performance and security together. The second is a hardening programme, worked through item by item. The third measured what the servers can carry.
That first document still lists every finding it ever had. A closed one shows the commit that closed it.
What is missing here is missing on purpose. Every line above this one names a file, a figure or a date. Where there is none of the three, there is no line.