> ## Documentation Index
>
> Fetch the complete documentation index at: https://lithi.ai/llms.txt
>
> Use this file to discover all available pages before exploring further.

---
title: Compute security
description: >-
  Where your plaintext can exist, what protects it in transit and at rest, which
  data Compute refuses, and who is allowed to change any of it.
route: /docs/compute/security
page_id: docs-compute-security
page_type: hubIndex
content_layer: guided documentation
surface_profile: guided_docs
audience: Security reviewers, IT teams and organization administrators
voice: D
reader_question: What protects my data in Compute, and where do I check each control?
primary_action: See where plaintext can exist
source_locale: en-US
source_status: APPROVED
source_version: docs-compute-security-en-us-2026-09-05-v1
last_updated: '2026-09-05'
robots: index
claim_registry_pinned: true
claim_registry_resync: "npm run governed:tsx -- scripts/build-compute-public-claim-registry.ts --write"
---

## What this section covers

Security in Compute is four separate questions. Which data you may send. Where your data exists in readable form while work runs. What protects it in transit and at rest. And who is allowed to change any of that.

Each question has its own page below. None of these pages is a certification, and none of them replaces the agreement you sign.

## Verified processing

A quality preset states what a result was checked against: schema and deterministic validation, independent sample verification, a higher verification rate, or your own rubric.

Verification tells you how a result was checked. It never promises the result is correct.

## Where plaintext can exist

Your data is encrypted in transit and at rest. It exists in readable form in two bounded places. A bridge validates the frozen snapshot before work starts, and the executor holds it in working memory while your approved job runs.

Queues, logs, receipts and metrics never hold it. Lithi does not claim zero knowledge.

## Policies and retention

Data profiles decide what Compute accepts, and regulated or credential-bearing content is refused rather than cautioned. Policy profiles carry your locality and approval rules.

Retention depends on the data category. A working file and a signed receipt keep different clocks.

## Pages in this section

- [See where plaintext can exist](/docs/compute/security/encryption-and-plaintext)
- [Choose the data profile for your input](/docs/compute/security/data-profiles)
- [Set region and jurisdiction rules](/docs/compute/security/regions-and-jurisdiction)
- [Register credentials as references](/docs/compute/security/credentials-and-federation)
- [Understand the untrusted-input boundary](/docs/compute/security/untrusted-inputs)
- [Revoke access during an incident](/docs/compute/security/incident-and-revocation)
- [Read what each contract settles](/docs/compute/security/compliance-and-contracts)

## Reviewed trust and legal material

- [Review Compute security](/trust/security)
- [Review encryption evidence](/trust/encryption)
- [Review data and processing boundaries](/trust/data)