Security
What the product does with your documents, stated precisely.
Onirix indexes documents that were never meant to leave your organization. This page describes the controls that exist in the product today, and is deliberately silent about anything that does not.
Permissions before retrieval
Document visibility is enforced in the database query and in the search index filter. A passage the reader may not see never reaches the model.
Credentials sealed at rest
Provider API keys and database connection strings are encrypted with AES-256-GCM under a key the database never holds.
Your infrastructure, your model
Self-host the full stack in Docker and bring your own model provider. With Ollama, document text never leaves your network.
Authentication
Three ways in, each of which proves control of the email address before an account can act.
- Email and password with mandatory verification
- A new account cannot sign in until it clicks a mailed link. A sign-in attempt by an unverified account mails a fresh link rather than failing silently.
- Magic link
- A one-time link sent to the address. No password is stored for accounts that only ever use it.
- Google sign-in, when the deployment enables it
- Offered only if the operator configures OAuth credentials. A Google identity is linked to an existing account only when Google reports the address as verified and the existing account is verified too, so an unverified signup at someone else's address cannot capture their Google login.
- Password reset by mailed link
- Resets go through a single-use link to the account's verified address.
Sessions and devices
Every person can see where they are signed in. Workspace administrators can see everyone.
- Device list
- Each signed-in device is listed with its platform and last activity. A person can sign out of every other device in one action.
- Administrative revocation
- Anyone with the member management grant can end any session in the workspace. Revocation is immediate: the next request finds no session and lands on the login page.
- Invitations expire
- A workspace invitation is valid for seven days. Re-inviting the same address cancels the earlier link.
Document permissions
If someone cannot read a document, Onirix must not surface it through AI. One rule, evaluated in three places that must agree.
- Three visibility levels
- A document is visible to the whole organization, to selected teams plus the uploader, or to the uploader alone. Visibility is set on upload and can be changed later.
- Enforced in the query, not after
- The same access rule is applied in the PostgreSQL metadata query, in the OpenSearch retrieval filter, and by the indexer that writes the access tokens onto every chunk. Filtering never happens on results that were already fetched.
- Administrators do not bypass teams
- Administrative roles govern who can manage members, sources and settings. They grant no reading rights. An admin who is not on a team does not see that team's documents in search or chat.
- Private conversations
- A conversation belongs to its author. Cited passages are snapshotted with it, so an answer given last month can still be audited after the index has changed.
Workspace isolation
An organization is the tenant boundary. Nothing is shared across it.
- Scoped on every request
- Documents, search results, conversations, sources and membership are all resolved through the caller's organization. A request can never widen scope beyond a real membership row, even with a stale or forged active organization id.
- Team membership is intersected
- Teams are checked against the organization in scope. Membership of a team in another organization grants nothing here.
- No self-service tenants
- Members cannot create additional organizations from the interface, so a customer's knowledge cannot fragment into tenants that cannot see each other.
Roles and administration
Roles are data, checked on the server for every mutation.
- Built-in and custom roles
- Owner, admin and member exist in every workspace. Administrators can compose custom roles from a fixed set of grants over members, invitations, teams, sources, knowledge, skills, models, roles and usage.
- The interface is not the gate
- Hiding a control decides only what a page draws. The procedure behind every control re-checks the same grant, so forcing a hidden control open achieves nothing.
Secrets at rest
Workspaces bring their own credentials. A copy of the database must not hand them over.
- AES-256-GCM, random nonce per value
- Model provider API keys and connected database connection strings are sealed before they are written. Each value is authenticated, so a tampered or wrongly keyed value fails closed instead of decrypting to garbage.
- The key lives outside the database
- The encryption key is one environment variable held by the web and worker processes and by nothing else. A database backup, a replica, or a badly scoped query yields ciphertext.
- Opened once per request, server-side only
- Credentials are decrypted where the model call is made and never serialized to the browser.
Connected databases
When a workspace connects a PostgreSQL database, the model can ask questions of it. It cannot change it.
- One SELECT, wrapped
- Model-written SQL is embedded as a subquery inside a SELECT with a row cap. A second statement, an UPDATE, a COPY or anything that is not a single SELECT is a syntax error and never reaches the database.
- Read-only transaction with a timeout
- Every query runs inside a READ ONLY transaction with a statement timeout, and the transaction is always rolled back.
- Read-only role recommended
- The administrator connecting a database is asked to use a read-only role. Three layers, so a bug in one is caught by the next.
Model providers and hosting
You decide which model sees your documents, and where the software runs.
- Bring your own provider
- Chat and embedding calls go to the provider the workspace owner connects, under that workspace's own credentials. Onirix never routes document text through a provider you did not choose.
- Fully local is an option
- With Ollama for both chat and embeddings, a deployment answers questions without any outbound request.
- Nothing model-written executes
- Charts are generated as validated data, not as code or images, so no model output runs against private data.
- Self-hosted in Docker
- PostgreSQL, OpenSearch, Redis, and MinIO or any S3-compatible store, on infrastructure you operate. Uploaded originals stay in your object store.
Certifications and questionnaires
No audit claimed. Every control checkable.
Onirix has not yet completed a third-party audit such as SOC 2 or ISO 27001, and this page does not claim one. What it offers instead is a precise account of the controls in the product, each of which can be checked against the source. If your review needs a questionnaire completed or a control examined in more depth, write to us and we will answer directly.
Security contact
Questionnaires, data handling questions, and vulnerability reports all go to the same address. Please include enough detail for us to reproduce a finding.
Self-hosting keeps data in the region and under the controls your organization already operates, which is usually the first thing a data protection review asks about.