Security model
What an attacker gets with our database, our logs, or the link.
With the database
Ciphertext and metadata. No key exists in it to steal.
With the logs
No bodies on secret paths, an allowlisted set of headers, and a redaction probe in CI that fails the build if a fixture value ever appears in a log line.
With the link
Everything. The link is the secret - that is the trade the design makes, and it is why links destroy themselves.