Authenticated Hava Business connections use a server-sealed vault reference. Credentials are encrypted and integrity-protected with Hava's server-only HAVA_CONNECTION_ENCRYPTION_KEY; browser-authorized Firestore is never used to store or retrieve connection secrets.
The business owner provisions or rotates a credential through an authenticated Hava API. Hava returns an opaque, encrypted vault reference bound to the owner, business, and connection. When live data is required, Hava's server opens that reference in memory, verifies its ownership metadata, decrypts the credential, performs the approved read-only HTTPS request, and returns only the tool result to the intelligence runtime.
This design does not depend on Firebase Admin permissions or client Firestore rules for secret persistence. The reference is unusable without Hava's server-only encryption key and is cryptographically bound to its connection metadata. Legacy havaBusinessConnectionVault Firestore documents remain fully denied to clients.
Changing a connection credential creates a new sealed reference. If the encryption key is unavailable, changed, or the reference is modified, Hava fails closed and asks the owner to revalidate the connection.
Live Connections remain HTTPS, JSON, GET-only, SSRF-protected, size-limited, and time-limited. Knowledge does not grant action permission. Write capabilities are a separate authorization layer.