Our security principles.

• Content is not stored by default

  Prompt, response, secret and personal data content is never written to logs, metrics, events or error messages; these records hold only keyed HMACs and metadata.

• Evidence carries position

  An evidence record holds the message, byte range and entity type; never the text itself.

• Tenant isolation

  Row-level security in the database, a mandatory tenant parameter in analytics queries, and a tenant segment in cache and message-queue keys.

• Signed policy

  Policy bundles are signed; when the data plane cannot reach the control plane it keeps running on the last signed bundle.

• Tamper-evident audit trail

  The audit trail is hash-chained per tenant and written to immutable storage.

• Operator access is limited

  The Cloud operator panel runs on a separate network with a separate identity provider and mandatory MFA; it reads only organization directory information and has no access path to tenant data. The operator panel contains no content.

• No external network dependency

  In on-prem installs, fonts, icons and scripts are bundled. This site does not load anything from external sources either.

• Explicit failure mode

  Every call to an external dependency has a deadline; when it is exceeded, the mode chosen by the application (open/closed) applies and the decision is flagged.

Vulnerability disclosure

The responsible disclosure channel and address will be listed here once published.