Security

Separate the public edge from powerful local tools.

The builder admin API remains loopback-only. Commerce runs as a separate service with PostgreSQL, verified webhooks, replay-resistant installation requests, and auditable grants.

Payment boundary

Hosted checkout prevents card data from entering Reallexi Pages. Raw webhook signatures are verified and events are processed idempotently.

Model and token custody

Model files, datasets, prompts, and Hugging Face tokens remain local. Introspection includes only installation identity and requested capability.