Security and data handling

Each index is a separate collection, and every query carries a server-side organisation filter that callers cannot override.

Keys are shown once and stored as SHA-256 hashes. They can expire, be rotated with a grace period, or be revoked.

Enterprise organisations can sign in through their OIDC identity provider after verifying an email domain. SAML is not available yet; every sign-in is plan-gated so a downgrade revokes IdP access at once.

The widget uses short-lived session tokens (15 minutes by default, one hour at most) minted on your server and limited to searching one index.

Documents can carry an access list; results, counts and facets are filtered before they are computed, so hidden documents do not leak through totals.

Crawlers and connectors only fetch public http(s) addresses and re-check every redirect, so they cannot be pointed at internal networks.

Per-key limits on every API endpoint and per-IP limits on public endpoints such as the widget and health checks.

Public error codes and messages never include engine internals, stack traces or other customers' identifiers.

Administrative changes — keys, rules, experiments, connectors, purges — are recorded with actor and time.

An organisation can export its data and delete all of it, including indexes, documents, logs and graphs.