# Trust & security

> Status URL, auth and HMAC signing, CAD data handling, and what latency on the status page does and does not mean. No invented SLAs.

Source: https://fourechelon.com/docs/trust-security · Machine-readable: https://fourechelon.com/openapi.json · Index: https://fourechelon.com/llms.txt

## Controls

| Control | Status | Detail |
| --- | --- | --- |
| Status | https://status.fourechelon.com | Live probes for web, CAD converter, and Rowe. latencyMs is a single probe, not an SLA. |
| API auth | Bearer / X-API-Key | Paid key required for /api/v1/responses, /cad/extract, and /cad/import-feature-tree. |
| Partner webhooks | HMAC-SHA256 raw body | X-Four-Echelon-Signature, X-Adam-Signature, or X-Hub-Signature-256. |
| CAD uploads | Processing only | Do not rely on long-term storage of uploaded files; persist outputs yourself. |
| Training default | Not customer uploads | Production inference does not train on customer CAD unless a separate agreement says so. |