# Connectors

Saved connector types are proxy, storage, CAPTCHA, and LLM. Each belongs to one user and exposes only non-secret metadata, status, capabilities, and a safe fingerprint.

Secrets are stored only as authenticated envelope ciphertext using a per-connector data key and versioned root wrapping material outside PostgreSQL. Plaintext must never enter logs, metrics, traces, task records, object storage, or backups. Only the control plane decrypts a secret, and only for the bounded operation that needs it.

Statuses are `pending`, `verifying`, `verified`, `degraded`, `invalid`, `disabled`, and `deleted`. Repairing a connector triggers verification and resumes eligible waiting jobs.