Security model

Controls that exist, described as what they are. Nothing here has been independently audited.

The local endpoint binds to loopback by default. Putting it on a network is an explicit act.
It requires a bearer token generated on the machine that runs it.
Under Docker the runtime is isolated, documents are read-only, and memory and CPU have ceilings.
The local index is not encrypted at rest today.
A document is untrusted input: a model reading a document can be influenced by what it says. Treat answers from untrusted documents accordingly.

There is no end-to-end encryption, no compliance certification and no penetration test report. When any of those exists it will be named with a date and a scope. To report something, see responsible disclosure.

Last updated 2026-09-22T10:05:46-04:00 · Request access

These pages describe the contract: ports, endpoints, volumes, the permission model and the behaviour you can expect. The command reference for the CLI is published with the build each tester receives, so that it matches the binary in their hands rather than a page written ahead of it.

Available through a controlled private beta. Larger model profiles are added as they complete hardware validation.