Provenance syncs extracted trust statements into Keystone. Graphsync requires KEYSTONE_STATEMENT_URL or KEYSTONE_URL; without it the directory and crawlers still run but graph consumers see no new statements.
Do you support OIDC / SSO?
Production uses the BFF with Zitadel. Configure issuer, audience, BFF client credentials, and run `djed zitadel sync --cell provenance`. Demo mode uses synthetic claims for local dev.
Where is data processed and stored?
You operate Postgres, Redis, and edge placement. Residency is determined by your deployment region. Customer trust pages and evidence metadata stay in your Provenance database.
What is the Trust & Compliance bundle?
Certus (NIS2) plus Provenance (vendor trust) with a Stripe coupon (`trust_compliance_duo`). Use `djed stripe sync` to materialize coupons and prices.
How do custom domains work?
Paid plans can attach a hostname to a published trust page. Caddy calls the gateway `/internal/customdomain/check`, which verifies plan tier (free/community blocked).
What SLAs apply?
SLAs are contract-specific for enterprise. Platform cells expose `/readyz` and Prometheus metrics for your own SLO dashboards.
Can I export my data?
Yes — Postgres exports plus object storage buckets for evidence blobs. See RUNBOOK RB-008 backup section.
How are crawls rate limited?
The crawler enforces per-host minimum gaps (default 90s, override with PROVENANCE_CRAWL_MIN_HOST_GAP). The gateway enforces per-plan RPS and monthly API quotas via Redis.
How do I cancel?
Stripe Customer Portal sessions are issued from billing; enterprise customers follow contract off-boarding with data export and key rotation.