Security
The posture as facts, including the honest limits. This is a private single-operator deployment engineered like a product, not a certified enterprise service — both halves of that sentence matter.
This layer is kept in English so it stays current; the full story lives at /principles in Nepali, English, Japanese, and Hindi. Machine map: /llms.txt. Everything here is true as of 2026-08-20; plans are labeled as plans.
Data protection
- User files encrypted at rest (authenticated encryption); transport is HTTPS everywhere with HSTS.
- Backups are on-server today; off-site backups are not currently protecting this deployment.
- Cached document text is stored no more readably than the file it came from.
Access control
- Real accounts with refresh-token sessions; login rate limiting; per-user storage, daily-token, and spend quotas with a circuit breaker.
- File downloads use short-lived, download-scoped tokens — never the access token in a URL.
- Documents are owner-scoped; sharing is an explicit per-document grant; thread attachments are visible to thread members only.
Acting safely (the ladder)
- Every action follows the authority ladder: observe → advise → draft → act with confirmation → act & report → act silently. Today almost everything sits at "act with confirmation" — nothing executes unconfirmed, and every action leaves a permanent audit record.
- Prompt-injection posture: content fetched from the outside world — web pages, email — is treated as data, never as instructions, and writes stay human-confirmed precisely because assistants that act on injected instructions are a known failure class.
- Sensitivity is classified the moment data arrives, so disclosure rules and provider routing can hang off it.
Operator access
Support access is granted by the member, revocable, and recorded; every admin request lands in a tamper-evident audit log. Running the deployment (quotas, suspensions, deletion on request) never requires reading anyone's content. See /privacy for the member-facing view of the same rule.
Honest limits
- Enforcement of operator separation is application-level and audited, not yet cryptographic — the operator still runs the database. Cryptographic separation is planned for the first community the operator does not run.
- No SOC2 / ISO certification, no external pen test yet — a compliance program is a public-phase cost, deliberately.
- Voice audio transits Google's speech APIs today; continuous home audio through third parties is the reason self-hosted speech is a named goal.
Reporting
Security findings are welcome and reach the operator directly through the feedback form on /principles. Good-faith research against your own account's data is appreciated; other members' data is off-limits.