OIDC SSO
Any spec-compliant IdP. Okta, Keycloak, Authentik documented; Entra ID. Authorization Code + PKCE; Back-Channel Logout.
group allowlists · admin group mapping
GitHub stars
18,273
DocsGPT security
DocsGPT security rests on where you run it: on-premises and air-gapped deployments keep documents, prompts and models inside your network, with OIDC SSO, SCIM 2.0, role-based access, an append-only audit log and guardrails with human approval. The code is MIT-licensed with a public threat model, SBOM and CodeQL scanning; vulnerabilities are reported privately via GitHub.
MIT · public threat model · SBOM · CodeQL · SECURITY.md ↗
Last updated: · Facts checked on
Security posture by deployment: Cloud · Managed · On-premises · Air-gapped
Air-gapped means zero external network: local LLM, local embeddings, a self-hosted vector store and local file storage, or your own S3-compatible store if you prefer one. Hybrid is an on-premises platform with a cloud LLM of your choice; it is not air-gapped.
Cloud and Managed are operated by Arc53 under a 99.9 % uptime SLA with daily backups and point-in-time recovery; On-premises and Air-gapped are operated by the customer inside their own network. Only Air-gapped has no external egress at all.
| Cloud | Managed | On-premises | Air-gapped | |
|---|---|---|---|---|
| Data location | Arc53 cloud, EU region | Dedicated instance in the Americas, Europe, Middle East, Africa or Asia | Your data centre or private cloud | Your network |
| LLM location | Cloud provider via Arc53 | Cloud provider via Arc53, a local engine on the instance, or your own provider key (BYOM) | Local engine, or your cloud LLM (hybrid) | Local engine only |
| Network egress | Yes: LLM provider | Yes: LLM provider | Optional (hybrid only) | None |
| Who holds encryption keys | Arc53 and its hosting provider; no customer-managed keys | Arc53 and its hosting provider; customer-managed keys per contract | Customer | Customer |
| Who operates | Arc53, multi-tenant | Arc53, dedicated instance | Customer, with Arc53 support | Customer, with Arc53 support |
| Uptime SLA | 99.9 % uptime | 99.9 % uptime | Per contract | Per contract |
| Backups and recovery | daily · point-in-time recovery | daily · point-in-time recovery | Your platform, or per contract | Your platform, or per contract |
| Identity | OIDC SSO, SCIM 2.0 | OIDC SSO, SCIM 2.0 | OIDC SSO (Okta, Keycloak, Authentik, Entra ID), SCIM 2.0 | OIDC SSO, SCIM 2.0 against your internal IdP |
| Vendor access to content | Yes (Arc53 service processes content) | Yes (Arc53 operates the dedicated instance) | No | No |
| Customer data used to train models | No | No | No | No |
Hybrid = on-premises platform + cloud LLM; not air-gapped.
Data flow by posturedashed = crosses your network boundary
Text version
Cloud: your browser talks across the network boundary to DocsGPT and its vector store in the Arc53 cloud; DocsGPT calls an LLM provider. Managed: the same flow, but DocsGPT and the vector store run on a dedicated instance in your chosen region. On-premises: browser, DocsGPT, vector store and a local LLM all run inside your network; optionally (hybrid) DocsGPT sends prompts to a cloud LLM you choose, which is the only boundary crossing. Air-gapped: browser, DocsGPT, local LLM, local embeddings, vector store and file storage all run inside your network with no external network at all.
Guardrails and approval gates
Guardrails run at four intervention points: user input, retrieved sources, tool results and the final answer. Seven built-in checks cover PII, credentials and secrets, banned terms, link policy, prompt-injection heuristics, grounding in retrieved sources and LLM-judge custom policies. Each check can flag, redact or block, run in monitor-only mode, and be set to fail open or fail closed. Human approval can be required for chat responses and for tool calls, and every decision is logged.
- Four intervention points
- User input · retrieved sources · tool results · final answer.
- Seven built-in checks
- PII · credentials/secrets · banned terms · link policy · prompt-injection heuristics · grounding in sources · LLM-judge custom policies.
- Actions
- Flag, redact or block. Monitor-only mode for tuning. Fail-open or fail-closed per check.
- Human approval
- Required, optionally, for chat responses and for tool calls; approvals and rejections are logged.
- Limits
- Per-user and per-agent token and rate limits.
Identity: SSO, SCIM and role-based access
DocsGPT authenticates against any spec-compliant OIDC identity provider using Authorization Code with PKCE; Okta, Keycloak and Authentik are documented and Entra ID works the same way. Group allowlists and admin-group mapping control who gets in and who administers; Back-Channel Logout ends sessions when the IdP does. SCIM 2.0 provisions and deprovisions users with immediate session revocation.
SCIM 2.0
User lifecycle from the IdP with immediate session revocation on deprovisioning.
create · update · deactivate → sessions revoked
Roles
Global user and admin roles resolved server-side, never trusted from the client.
user · admin
Teams and workspaces
Viewer/Editor sharing inside teams; shared tools run on the owner's credentials without exposing secrets to other users.
viewer · editor · owner credentials
Audit logs
The auth_events log is append-only and exportable: logins, denials, SCIM lifecycle events, role changes and forced logouts. Guardrail decisions have their own events panel, and a unified logs timeline joins them with agent runs. Token and cost usage is attributed per agent, team and user. OpenTelemetry export sends all of it to your SIEM or observability stack.
auth_events
Append-only: logins, denials, SCIM lifecycle, role changes, forced logouts. Exportable.
append-only · export
Guardrail events
Every flag, redaction, block and approval decision with the check that fired.
flag · redact · block · approve
Unified logs timeline
Agent runs, tool calls, guardrail events and auth events on one timeline.
agent · tool · guardrail · auth
Cost attribution and export
Tokens and cost per agent, team and user; OpenTelemetry export to your SIEM.
OTel → your SIEM
Sandboxing and isolation
Code execution runs in a sandboxed Jupyter kernel when self-hosted, or in Daytona. Secrets are scrubbed from the kernel environment and internal network egress from the sandbox is blocked with a Kubernetes NetworkPolicy. Bring-your-own-model endpoints are SSRF-protected. Artifact bytes never pass through the model. The remote-device tool has approval modes, a denylist and its own audit log.
Sandboxed code execution
Jupyter kernel (self-hosted) or Daytona; secrets scrubbed from the kernel environment.
jupyter · daytona
Network isolation
Internal egress from the sandbox blocked by NetworkPolicy; BYOM endpoints checked against SSRF.
NetworkPolicy · SSRF guard
Artifacts
Generated DOCX, PPTX, XLSX and PDF bytes never pass through the model.
docx · pptx · xlsx · pdf
Remote-device tool
Approval modes, denylist and audit log for actions on remote devices.
approve · deny · log
Documentation
docsgpt — code_executor
quarterly-report.docx
artifact · append-only versions
- v1generated · 3 sources cited09:14
- v2regenerated with Q3 figures09:21current
Encryption
Two layers: what the application encrypts, and what the platform underneath provides.
Application layer · all postures
- Credentials and connector secrets are encrypted at rest by the application.
- Agent exports strip secrets.
- Device tokens are hashed and revocable.
credentials · exports · device tokens
Platform layer · On-premises, Air-gapped
For On-premises and Air-gapped deployments, disk and database encryption at rest and TLS in transit are provided by your platform, under your keys.
your disks · your database · your TLS · your keys
Platform layer · Cloud, Managed
For Cloud, the database, including vector embeddings, is encrypted at rest with AES-256 by the database provider, object storage uses server-side encryption, and TLS 1.2 or later carries traffic to the edge and on to every sub-processor. Managed instances inherit the same from their hosting provider.
AES-256 at rest · TLS 1.2+ in transit
Open-source supply-chain programme
DocsGPT is a GitHub Secure Open Source Fund participant (2026-08). The threat model is public (STRIDE), a software bill of materials is published, and CI runs CodeQL, Bandit and zizmor alongside Dependabot and secret scanning. Vulnerabilities are reported privately through SECURITY.md and handled under an incident-response playbook.
Programme
GitHub Secure Open Source Fund
Participant since 2026-08.
2026-08 · participant
Threat model
THREAT_MODEL.md
Public STRIDE threat model for the platform.
STRIDE
SBOM
Software bill of materials
Exportable in SPDX format from the repository's GitHub dependency graph.
spdx · dependency graph
Dependencies
Dependabot
Automated dependency updates and alerts.
dependabot.yml
Static analysis
CodeQL · Bandit · zizmor
Code, Python and GitHub Actions workflow scanning in CI.
codeql · bandit · zizmor
Secrets
Secret scanning
Repository secret scanning with push protection.
push protection
Disclosure
SECURITY.md
Private vulnerability reporting via GitHub.
private reporting
Response
Incident response playbook
Severity scale, triage, fix, release and advisory steps.
triage → fix → advisory
Files in the repository
Contributors
226+
on GitHub
Licence
MIT
Cloud sub-processors
Applies to Cloud and Managed only. On-premises and Air-gapped deployments have no Arc53 sub-processors: nothing leaves your network. On Cloud, sub-processors fall into two groups: core infrastructure, which handles data whenever the service is used, and model and tool providers, which receive it only when a user or agent selects that model or tool. Each one, with its region and transfer mechanism, is listed in Annex III of the Data Processing Addendum, and changes are notified at least 15 days before they take effect. A Managed instance is provisioned for one customer, so its sub-processors and their regions are agreed with that customer rather than published here.
Vulnerability disclosure
Report vulnerabilities privately through GitHub's private vulnerability reporting or to security@arc53.com, as described in SECURITY.md; the handling process is the public incident response plan. Security patches target the latest release and the main branch, so run the current release. Do not open a public issue and do not use the contact form.
- 01
Report privately
Use GitHub private vulnerability reporting on the DocsGPT repository, per SECURITY.md.
github.com/arc53/DocsGPT/security
- 02
Acknowledgement
Arc53 aims to acknowledge reports within 48 hours and validates the issue against the latest release and main.
48 h · security@arc53.com
- 03
Fix and release
Critical and High: fixed in a patched release with disclosure coordinated with the reporter, goal within 90 days. Medium and Low: included in the next scheduled release unless the risk requires an out-of-band patch.
critical/high ≤ 90 days · medium/low next release
- 04
Also patched
The managed cloud deployment is patched as soon as the fix is validated.
app.docsgpt.cloud
- 05
Coordinated disclosure
The advisory is published on GitHub once a fixed version is available, with affected and fixed versions.
- 06
Credit
Reporters are credited in the advisory unless they ask not to be.
Security advisories
DocsGPT publishes security advisories on GitHub. Four advisories have been published to date; each has been fixed in a released version. Details are as published on the GitHub advisories page.
| Severity | Affected versions | Fixed version | Published | |
|---|---|---|---|---|
| GHSA-gcrq-f296-2j74 · CVE-2026-26015 | Critical | ≥ 0.15.0, < 0.16.0 | 0.16.0 | 2026-04-28 |
| GHSA-m448-vp23-j393 | High | < 0.15.0 | 0.15.0 (advisory gives the affected range only) | 2026-06-07 |
| GHSA-6gxj-6hq5-hqcj | Medium | All versions before commit 249dd9c | Commit 249dd9c; in 0.17.0 and later | 2026-06-07 |
| GHSA-p5qc-vj2x-9rjp · CVE-2024-31451 | Low | 0.5.0 | 0.8.1 | 2024-04-12 |
As published on GitHub, checked 2026-09-11.
If you run DocsGPT, run the current release (v0.21.0) and follow the release notes for upgrade steps.
Certifications
DocsGPT does not hold a SOC 2, ISO 27001 or Cyber Essentials certificate today. The evidence for a security questionnaire is the posture you choose plus the programme above: a public threat model, SBOM, CodeQL and dependency scanning, coordinated disclosure and an inspectable MIT codebase.
- SOC 2
- Not held
- ISO 27001
- Not held
- Cyber Essentials
- Not held
- Hosting provider certifications (Cloud, Managed)
- Inherited from the hosting provider
How to make AI GDPR compliant with DocsGPT
GDPR compliance is the deploying organisation's responsibility; DocsGPT supplies the controls. Keep personal data inside your jurisdiction by running on-premises, in the EU region on Cloud or in a chosen Managed region, sign a DPA, log every access, delete on request and redact PII before it reaches a model.
Data minimisation by posture
Air-gapped and On-premises keep documents, prompts and embeddings inside your network; nothing is sent to Arc53.
on-premises · air-gapped
Residency
The EU region on Cloud; the Americas, Europe, Middle East, Africa or Asia on Managed, chosen at provisioning; or your own data centre.
EU (cloud) · 5 regions (managed) · your DC
DPA
The Data Processing Addendum for Cloud and Managed, with its processing details, security measures and sub-processor annex, at /dpa.
/dpa
Audit and deletion
Append-only audit log; deletion of sources, conversations and users by an admin.
auth_events · delete
PII guardrails
Flag, redact or block PII on input, retrieved sources and answers.
pii · redact
Security questionnaire shortcuts
The standard questionnaire questions, each linked to its answer.
| Answer | |
|---|---|
| Where is our data stored and processed? | Posture table · Cloud, Managed, On-premises, Air-gapped |
| Is our data used to train models? | No, on any posture · Posture table |
| Does any data leave our network? | Posture table (air-gapped definition) · Air-gapped deployment |
| Which IdPs are supported; is SCIM available? | Identity · docs OIDC SSO, SCIM |
| Is there an audit trail and can we export it? | Audit logs · docs Admin, Observability |
| Can the LLM execute code or call tools safely? | Sandboxing · docs Tools, Code execution |
| Are prompts/answers checked for PII or injection? | Guardrails · docs Guardrails |
| Encryption at rest and in transit? | Encryption |
| Sub-processors and DPA? | Cloud sub-processors · DPA |
| How are vulnerabilities reported and fixed? | Vulnerability disclosure · Advisories · SECURITY.md |
| Certifications held? | Certifications |
| Licence and source availability? | GitHub repository · MIT |
| Uptime commitment, backups and recovery? | Posture table (99.9 % uptime on Cloud and Managed; daily backups, point-in-time recovery) · Pricing |
| Business continuity / key-person risk? | MIT core, open-format export, documentation · Pricing FAQ |
Frequently asked questions
How to make AI GDPR compliant?
- Keep personal data inside your jurisdiction (on-premises, the EU region on Cloud, or a chosen Managed region), sign a DPA, log access, and redact PII before it reaches the model. DocsGPT supports each of these, but compliance is the deploying organisation's responsibility.
What does air-gapped mean in tech?
- No connection to external networks. In DocsGPT this means the LLM, embeddings, vector store and file storage all run locally, with no outbound calls.
Can air-gapped systems be compromised?
- Yes, through insiders, removable media or the supply chain. DocsGPT reduces this with an inspectable MIT codebase, SBOM, sandboxed code execution, approval gates and an audit log.
Has DocsGPT had security vulnerabilities?
- Yes; they are published on the GitHub advisories page with fixed versions. Run the current release and report new issues through SECURITY.md.
Do you hold SOC 2 or ISO 27001?
- No. See Certifications for the evidence in place instead: posture, public threat model, SBOM, code scanning and coordinated disclosure.
See DocsGPT on your documents
A 30-minute demo, or a free on-premises review of your hardware, identity and network posture with an Arc53 engineer.