Organization-scoped API keys
Every customer request resolves an organization from the authenticated key. Callers cannot submit or override organization_id.
Trust and status
Operational proof without persistent PHI.
ActionReceipts.ai is designed to record signed evidence of agent actions while keeping patient identifiers, raw prompts, completions, screenshots, DOM snapshots, and source-system payload bodies out of storage.
Storage posture
Zero persistent PHI
Receipt metadata only; customer correlation remains opaque.
Evidence model
ES256 signed receipts
Signature key ID is bound into every signed payload.
Current verification
64 API tests passing
Postgres live tests are gated behind explicit environment variables.
Healthcare Audit Mode
What ActionReceipts.ai stores
Stored as evidence
- Receipt ID, organization boundary, tenant metadata
- Agent, action, tool, target system, policy verdict
- Human approval metadata and risk classification
- PHI exposure level and non-PHI policy rule labels
- Signed payload, signature key ID, timestamps
Rejected from storage
- Raw prompts and completions
- Screenshots, DOM snapshots, source-system payload bodies
- Patient identifiers, claim details, clinical notes
- Full URLs or logs containing PHI-bearing values
- Persistent payloads marked as stored by the caller
Controls
Security posture for beta deployments
Suspended subscription blocking
Billing state lives locally. Suspended states return `403 subscription_suspended` before customer API actions proceed.
Local usage source of truth
Receipt creation records usage locally first and never blocks audit evidence creation.
Request hardening
Customer and admin rate limits, request size limits, and zero-PHI validation run before receipts are accepted.
Status
Current beta readiness
| Area | Status |
|---|---|
| Receipt API | Ready for demo |
| Verification | Ready for demo |
| Healthcare Audit Mode | Ready for beta |
| Receipt Console | Next build |
Security review packet available during beta onboarding.
Healthcare workflows require signed BAA coverage before PHI-touching production use.