Security and privacy
Promises in plain words. Proof on each page.
Security is a product rule, not a page in the footer. Every promise below links to a page with the same four blocks: the promise, what is implemented today, what is planned and when, and how to check it yourself. We say planned where it is planned. There is no release yet, so most implemented blocks are short.
| Promise | What it means | Status | Phase |
|---|---|---|---|
| Your building works without the cloud. | A self-hosted Archipelago does everything with the WAN unplugged. The whole test suite will run with the network turned off. | Planned | Phase 3 |
| Your engineering belongs to you. | Imported files stay on the machine you imported them on, encrypted, and are never used to train anything, by anyone. | Planned | Phase 2–3 |
| Self-hosted means self-contained. | No update checks, crash reports, analytics, outside fonts or outside scripts. What you install is everything it needs. | Planned | Phase 3 |
| No surprise uploads. | The software never contacts Archipelago infrastructure unless an administrator turns on a specific integration, and the screen that turns it on says exactly what will be sent and where. | Planned | Phase 3 (edge), Phase 6 (hosted) |
| Read-only by default. | Connectors read. Writing to a building is a separate capability that is off until a named person turns it on, and every write is logged. | Planned | By design; Phase 3 |
| Cloud is optional. | Remote access and multi-site views are services you can add. They are never a requirement, and turning them off leaves everything else working. | Planned | Phase 6 |
| No AI required. | Archipelago is useful with no language model anywhere near it. If you want to point one at it, the tools are there and they are read-only. | Planned | By design |
| Open source means inspectable. | Every line that touches your files is public. Read it, or have someone you trust read it. | Planned | With this site's launch; then the platform as it is written |
The rest of the security documentation
Threat model
Who we think the attackers are, what they want, and where the boundaries are.
Connectors
What a connector does on your network, what it cannot do, the permissions it needs, and how to remove it.
Supply chain
How you know a release is ours: signing, checksums, SBOM, and the rule that the signing key is never in CI.
Responsible disclosure
How to report a vulnerability, what we do with it, and what is in scope.
Hosted data handling
For the optional hosted service that does not exist yet: what would be uploaded, stored, deleted, and by whom.
Third-party services
Every outside service the software or this site can talk to, and when. Today: none at runtime.
Two rules above all
- Self-hosted operation never phones home by default. No update check, no crash report, no analytics, no outside asset. Enabling any outside connection is an administrator's deliberate act, and the screen that enables it says what will be sent and where.
- Customer engineering artifacts are never uploaded without explicit authorization. Not to us, not to a model provider, not to anyone. Imported files stay where you imported them.
Vocabulary: implemented means it exists in released code or on this site and you can check it. Planned means it is designed and scheduled. Tested means a test in the public repository proves it and runs in CI. We do not claim compliance, certification, or zero-knowledge encryption.