Trust & Security
A plain-language view of the technical controls we have verified, the work still in progress, and the checks we run against our operating environment.
13 of 23 published checks verified. This is a control-status snapshot, not a security certification.
Current operating posture
Restricted database access
PostgreSQL uses SCRAM authentication, role-based access, and private-network access. Only the administrative database role has superuser privileges.
Encrypted service connections
The latest scan verified PostgreSQL SSL and Redis TLS. Temporal mTLS remains an open hardening task.
Secret handling under review
Runtime injection and named credential references reduce secret exposure. The latest scan also found file-permission exceptions that need remediation.
Self-hosted operational telemetry
We operate a self-hosted Grafana, Loki, and Tempo stack for diagnostics. We do not describe this as “zero vendor”: infrastructure and backup providers remain subprocessors.
Backups tested for recovery
Daily encrypted backup archives and off-site storage are active. A restore test passed on 24 August 2026; backup retention is configured for 30 days.
Privacy Controls
Published checks verified
Security Controls
Published checks verified
AI Governance
Published checks verified
Data Privacy & Observability
Consent records
Resource delivery and marketing opt-in are recorded separately, with consent wording, version, timestamp, and region evidence retained for auditability.
Optional measurement consent
Optional HubSpot and Meta measurement are loaded only after marketing consent; essential site and resource-delivery functions remain available without it.
PII safety checks enabled
The latest host scan verified that the application safety-injection check is enabled. This check is one layer of protection, not a guarantee that every identifier is removed.
Knowledge Base database TLS enforcement
The Knowledge Base database is reached over the private container network. We still need to enforce and verify sslmode=require in its connection configuration.
Knowledge Base public-release controls
Production registration remains gated on product-specific Terms, Privacy Notice, acceptable-use rules, data-processing terms, versioned registration consent, and tested deletion and incident procedures.
Infrastructure Security
Private service access
The Knowledge Base service ports are limited to loopback or the private tailnet rather than listening on every network interface.
Firewall and private administration
The host firewall is active and administrative access uses a private tailnet.
Unexpected network listeners
The latest scan found two services listening on all interfaces that are not yet on the approved list. Their exposure and intended configuration are being reviewed.
Encryption
Data in transit (database)
The latest host scan verified that PostgreSQL SSL is enabled. Knowledge Base client-side enforcement is tracked separately above.
Redis transport encryption
The latest scan successfully connected to the Redis TLS port and received a verified response.
Data in transit (internal)
Temporal mTLS is not configured. The service is network-restricted while certificate-based service authentication is added.
Data at rest (disk)
The host does not currently use LUKS full-disk encryption. Encrypted application backups reduce recovery risk but do not replace disk encryption.
AI Governance
Human-in-the-loop gates
A sender allowlist and approval system are configured for controlled actions.
LLM audit coverage
LLM call logging exists, but there were no calls in the latest 24-hour scan window to verify model and decision records end to end.
Prompt-injection control review
Injection handling is present. We still need to verify that it consistently covers every Knowledge Base LLM processing path.
Backup & DR
Local backup
The latest scan found a database backup less than one hour old; freshness is checked against a 48-hour limit.
Encrypted offsite backup
Encrypted backup archives are produced daily and backup retention is configured for 30 days.
Off-site backup
The latest scan verified that off-site backup storage is configured with Bunny Edge Storage.
Restore testing
A restore test passed on 24 August 2026, including database restoration and instance-archive validation.
Secrets & Software Supply Chain
Database authentication and roles
PostgreSQL host rules use SCRAM-SHA-256. The scan found 14 login roles, with only the administrative postgres role holding superuser privileges.
Secret file permissions
The latest scan found four environment files with permissions broader than our target. Permissions and any required credential rotation are being reviewed.
Dependency and image scanning
The worker base image is current, but automated Trivy and cargo-audit checks are not yet installed on the host.
Crawler and container hardening
The scan identified runtime-isolation improvements for the Knowledge Base crawler and a container with elevated host access. These findings are tracked for remediation.