For security teams

Corpus security overview

Corpus is a self-hosted AI knowledge base. The language model runs in Ollama on your server, and Corpus calls no cloud AI service. This page sums up how it protects the data; the full deployment guide comes with the product.

Print this page or save it as PDF from your browser.

Data location: Everything runs on your server, and the AI model is local. After installation no container reaches the internet: the only ways out are tunnels to the HashiCorp Vault, SSO provider and S3 storage you connect, each to that one address. Document files leave the server only if you keep them in S3, encrypted.
Network: Every service sits on an internal Docker network with no internet route. Only the HTTPS proxy is published. Model downloads, Vault, the SSO provider and the S3 storage each get a dedicated, narrow path. The first start downloads the AI models; later starts need no internet.
Encryption at rest: AES-256-GCM for document files, document text, search chunk text, chats and the error log. Backups are encrypted with the same key.
Key: Kept in backend/.env or in HashiCorp Vault, with an AppRole bound to the server. Corpus refuses to start with a key that does not match the data. Rotation re-encrypts everything, with one command.
Access control: Roles built from permissions, with no way to grant more than you hold, and the last administrator protected. Four document levels (standard, restricted, confidential, secret) are enforced in the document list, in search and in every answer.
Sign-in: Passwords hashed with bcrypt, sign-in throttling, 15-minute tokens rotated on refresh, sessions of 12 hours at most, cookies with CSRF protection. Single sign-on with OpenID Connect, PKCE and full ID token checks; roles follow the provider's groups.
Audit: Sign-ins and failures, changes to users, roles and documents, document reads, including the documents the assistant read to answer, and reads and deletions of other users' chats.
Web: HTTPS, HSTS, a strict Content-Security-Policy, and opened documents sandboxed.
Containers: The backend and the worker run as an unprivileged user with no Linux capabilities. Services sit on separate networks, and each gets only the secrets it needs.
Privacy: Logs never hold document text, chat content or secrets. Chats and errors are deleted after their retention periods (chats after 90 days without activity by default).

What the audit log shows

The Corpus audit log: sign-ins, two opened documents marked Secret and Confidential, and a confidential HR policy read by the assistant in a chat — The audit log of a test installation. The assistant read a confidential HR policy to answer Marta's question, and that read is logged like an opened document.

What Corpus does not encrypt

Document names, user emails, the audit log and search vectors are not encrypted by Corpus. Keep the server's data on an encrypted disk (LUKS); the deployment guide shows how.

Questions from your security team? Write to us or book a call with the author.