How LingerCut proves leftover trust is gone

Where data is stored

Public SaaS (lingercut.com) runs on Vercel in iad1 — Washington, D.C., United States. Access-request leads and kill receipts persist to Upstash Redis REST when those env keys are set (founder SaaS intends a US-East database alongside the app); otherwise they write local .data files, which are ephemeral on Vercel. LingerCut does not operate an EU-only region today.

Do you hold customer credentials?

LingerCut does not hold a vault of customer passwords, PATs, refresh tokens, session cookies, or API keys. Connector OAuth for a live cut lives in AES-GCM sealed operator-session cookies, not a long-lived LingerCut secret store. Public pages never ask visitors to paste live credentials. Kill receipts record cut metadata and the probe result — not the secret material.

What we log and how long

We log access-request fields you submit, support tickets (name, work email, company, redacted transcript), operator audit rows (login, cut, dual-control — never passwords), and kill-receipt metadata. Optional LLM prompts for Support phrasing exist only if an operator sets OPENAI_API_KEY; those prompts never stamp VALID. No default third-party product analytics.

Access-request retention and deletion: Privacy.

Subprocessors

• Vercel — App hosting and serverless API routes (the backend is those routes, not a separate AWS service). Region: Vercel iad1 (Washington, D.C., United States).
• Upstash — Redis REST for durable receipts, leads, and rate limits when configured. Region: Operator-chosen Upstash database; founder SaaS intends US East alongside iad1.
• Resend — Transactional founder notify only if RESEND_API_KEY is set. Proton hello@ is a mailbox, not SMTP. Region: Resend’s mail infrastructure; notify goes to the founder mailbox.
• OpenAI — Optional Support / Live Desk phrasing. Never cuts. Never stamps VALID. Unset = grounded FAQ only. Region: OpenAI processing region for the configured API.
• Cloudflare — DNS / MX for lingercut.com as configured. Region: Cloudflare anycast.

AWS IAM is a connector target on the customer's account, not a LingerCut home cloud.

Self-host status

Buyer-host Docker Compose (Sovereign) is documented. It is not a one-click self-host product, and LingerCut does not operate a dedicated VPC for you. Until a buyer runs Compose on their host, the public product is Vercel SaaS.

Standards map — design intent, not badges

LingerCut is not SOC 2, ISO 27001, NIST, FedRAMP, DORA, or GDPR certified. The rows below are how kill receipts map to those control families. They are not proof we passed an audit.

• NIST CSF / SP 800-53 (access control & evidence). Design intent: leftover access is cut out-of-band, then proved gone by failed replay or absence. Not a NIST certification.
• ISO 27001 A.9 (access rights). Control mapping for removal of leftover grants/sessions/keys. LingerCut is not ISO 27001 certified.
• SOC 2 CC6.1–CC6.3 (logical access). Control mapping for revocation evidence. LingerCut is not SOC 2 Type I or Type II certified.
• DORA (ICT residual access evidence). Design intent for financial entities who must prove access is gone after an ICT incident. Not a DORA attestation.

Kill receipt bar

• Cut out-of-band — not from the possibly stolen interactive session.
• Adversarial replay / absence probe of the old credential.
• VALID = bounce from a least-harm probe (read-only or absence re-list). WITHHELD = still live even if the IdP said revoked=true. Mutating probes cannot mint VALID.
• HMAC-SHA256 signature + hash chain when RECEIPT_SIGNING_SECRET is set.
• Check a pasted receipt at /verify. Sample walkthrough at /demo.

Rate limiting

Public support chat, sample receipts, tickets, access requests, and isolated probe replay (/api/probe/replay, per grant/org and IP) are rate-limited. Excess returns HTTP 429 with no kill receipt (same fail-closed as probe transport 503). Dual-control on live cuts stays.

Operator lock (honest)

• HMAC cookie lc_operator. Hard TTL 12 hours plus 45-minute idle. Production fail-closed until OPERATOR_SESSION_SECRET and RECEIPT_SIGNING_SECRET are set. People SSO or OPERATOR_PASSWORD unlocks the lock.
• Roles: viewer (receipts / export) · operator (cut) · approver (dual-control). Invite-only Google people-SSO (Microsoft optional; hidden unless configured). GitHub is not a people IdP. Connector OAuth (GitHub / Entra / AWS) is a different door.
• OPERATOR_PASSWORD is break-glass once SSO env is present. Successful break-glass is a loud audit row + in-app banner. OPERATOR_PASSWORD_APPROVER remains break-glass mapping to approver.
• Login attempts are rate-limited (8 / 15 min / IP). Session list + revoke at /sessions. Login canary is /audit plus banner; email only if a mailer key is actually wired (none ships by default — Proton hello@ is a mailbox, not SMTP).
• Receipts carry kid (default k1). Verify tries RECEIPT_SIGNING_SECRET then RECEIPT_SIGNING_SECRET_PREVIOUS. Mint only with current.
• ALLOW_FORCE_EXECUTE_IN_PRODUCTION is not honored. Public /demo does not unlock live GitHub or Entra.

If a secret leaks

• Detect: unexpected /audit login, Vercel team members, Upstash console access.
• Rotate OPERATOR_PASSWORD and OPERATOR_SESSION_SECRET together; revoke sessions.
• Rotate Upstash token; rotate PROBE_SHARED_SECRET on both Vercel projects.
• Rotate the leaked OAuth client secret (people-SSO or connector — they are separate apps).
• Receipt overlap: set previous signing secret, mint with current, keep 30–90 days.

What this is not

Not a SOC 2, ISO, NIST, DORA, FedRAMP, or GDPR certification. Not a clone of Okta, 1Password, or CrowdStrike. See why IdPs cannot prove residual access is gone and privacy.