Security

Security is built into how this site and its demos work. The measures below describe the current design; because the demos exist to test a system, they are provided without warranty (see Terms).

Transport

All traffic is served over HTTPS, terminated at Cloudflare; the origin is reached through a private Cloudflare Tunnel.

Access control

• Administrative areas require authentication.
• Live demos are gated behind a password plus a one‑time passcode (OTP) sent by email — two‑factor by design.
• Use of any demo requires accepting a testing disclaimer first.

Secrets

LLM and email credentials are held only on the server and are never exposed to the browser. Secrets live in environment configuration, not in source control.

Data handling

• Demo uploads are processed in memory, not written to a database or disk, and expire automatically (typically within an hour).
• Upload size limits and per‑user rate limits protect the service.
• The data demos execute only read‑only queries against an in‑memory engine.

Responsible disclosure

Found a security issue? Please email [email protected] with the details. Please do not publicly disclose until it has been addressed.

Important

No system is perfectly secure. Because the demos are for evaluation, do not submit confidential, regulated, or real personal data. See the Privacy Policy and Terms & Disclaimer.