RHA Provider Vault
🔐 Encryption at rest
All provider configs and API keys are encrypted with AES-256-GCM before being written to chrome.storage.local. Chrome storage is isolated to this extension — no website can read it.
🔑 Key derivation
Your vault password is never stored. Instead, a 256-bit encryption key is derived using PBKDF2 with 100 000 iterations and SHA-256. The derived key lives in service-worker memory only and is cleared on lock.
🚫 Keys never leave your machine
When activating a provider, your API key is sent only to your local RHA server at localhost. For direct LLM proxying, keys go only to the provider's own endpoint (e.g. api.anthropic.com). Your key never touches any third-party server.
🔒 Auto-lock
The vault locks automatically after 5 minutes of inactivity. The in-memory derived key is wiped; the vault cannot be accessed until the password is re-entered.
🌐 Origin allowlist
Only pre-approved origins can send messages to this extension (defined in externally_connectable). Arbitrary websites cannot request your keys or proxy calls through this extension.
📋 Audit log
Every activation and LLM proxy operation is logged with a timestamp, provider name, and outcome. No prompt content or key material is ever written to the log.