This document outlines the security guardrails and best practices implemented in the SOVR ORBIT Executive Intelligence OS to ensure institutional data integrity and safety.

All sensitive API keys, including the Gemini API Key, are stored exclusively on the server-side.

• The Protocol: The client communicates with the server.ts via WebSockets and REST APIs.
• Why? This prevents secrets from being exposed to the browser's developer tools or intercepted via client-side network inspection.

Secrets are managed through .env files which are strictly ignored by Git.

• Template: Refer to .env.example for the required structure.
• Runtime: In production (Cloud Run), secrets are injected directly into the environment, bypassing the need for physical files.

Workspace integrations (Calendar, Gmail, Contacts) utilize OAuth 2.0 delegated authorization.

• Tokens: Access tokens are retrieved via the client-side Firebase Auth provider and passed to the server-side proxy for executing specific mission-critical tasks.
• Scopes: The OS requests the minimum necessary scopes to perform organizational tasks.

The Institutional Knowledge Graph is stored in memory.json.

• Git Ignore: This file is excluded from version control to prevent leaking private organizational data.
• Template: A memory.json.example is provided to initialize new environments.

• No Hardcoded Keys: Audited codebase for AIza, sk-, and ghp_ patterns.
• Scrubbed Demo Backdoors: Removed the sovr-demo-token-bypass logic.
• Secure Transmissions: All WebSocket audio and text streams are encapsulated in the server-side session handler.
• Input Validation: Server-side checks ensure that LLM-requested tool calls (like send_email) have valid OAuth tokens before execution.

Operational Intelligence Phase II | Security Protocol V1.0