Security

Your content stays on your infrastructure

A vault runs where you put it — your own hardware or your own cloud account. It ingests, indexes, and serves your content locally, behind its own credentials. It works offline, and it keeps working if our hosted service goes away permanently.

Because of that, the ordinary worst case for a hosted service — the provider is breached and customer content leaks — does not apply to your content. It was never on our systems to leak.

The control plane cannot read your vault

Our hosted service coordinates: it authenticates people, brokers connectivity so a vault behind a firewall is reachable, and gives an administrator a view across their fleet. It is deliberately not a path your content flows into.

No role in the hosted service — including our own operator accounts — conveys access to vault content. That is enforced as a boundary in the architecture rather than as an internal policy. Every privileged administrative action requires step-up multi-factor authentication, is scoped and time-limited, requires a recorded reason, and is written to an append-only audit log.

The control plane proposes; the vault decides. An instruction sent from the hosted service to a vault is applied only if that vault’s own policy admits it, and privileged grants require the vault’s own signature in addition to ours. A compromise of our side can disrupt service; it cannot read your content or escalate access inside your vault.

Credentials and tokens

• We never receive your password for any service. Sign-in is delegated to your identity provider.
• Provider client secrets are not held by the hosted service in plaintext. Where a connection is set up through us, access tokens are delivered to your vault encrypted to your vault’s own key, and are not persisted by the components that pass them along.
• Credentials stored in a vault are encrypted at rest under a key belonging to that vault.
• Credentials do not cross domains: a credential issued for the hosted service cannot be exchanged for one that acts on your vault.

In transit

All traffic is encrypted in transit. If you pair a vault so it can be reached remotely, that traffic is relayed through our network edge on its way to your vault — relayed, not stored, inspected, or indexed. If you would rather no traffic of yours transit our infrastructure at all, run the vault standalone; that configuration is fully supported and always will be.

Logs and telemetry

Logs and error responses reference subjects by opaque identifier. Secrets, tokens, and personal values are not written to them. Operational metrics count and measure; they do not carry content.

Reporting a vulnerability

If you believe you have found a security issue, email info@libragraph.com with enough detail to reproduce it. We will acknowledge your report, keep you informed while we investigate, and credit you if you would like us to. Please give us a reasonable chance to fix an issue before disclosing it publicly, and please do not access, modify, or destroy data that is not yours while testing.