The security page says exactly what the server can see, and the list now has eleven rows.
The threat model was accepted today and the page follows it. Five things the server always held are now named: which device wrote each record, the account's security-event history, capture credentials and their last-used times, a passkey's signature counter, and the short-lived machinery a request needs.
The security page was brought in line with the accepted threat model. Its headline is now bounded by the list beneath it, which grew from six rows to eleven. Four sentences were tightened: record sizes are unpadded and stay so for records already written, the withheld-log remedy is open rather than nearly closed, a synced passkey is as reachable as the account it syncs to, and the seven-day IP retention names the logs it governs. The threat model and the list are the same document from today.