Security, Privacy & AI GovernanceAvailable
Trust and safety
How ILIR AI handles privacy, data, sources and the limits of its own authority.
Verified Controls in This Codebase
- Row Level Security (RLS): Every user-facing table in PostgreSQL enforces tenant isolation, verified by 108 automated pgTAP assertions.
- Server-Brokered Storage: Direct client writes to
user-filesare disabled; uploads require magic-byte verification and server-side quota checks. - Zero Arbitrary Code/Shell Tools: Built-in shell, filesystem, and unpinned web tools are disabled (`0 tools` exposed to untrusted prompts).
- Structured Log Redaction: API keys, JWTs, continuation tokens, and embedded error credentials are redacted before log emission.
Explicit Non-Claims & Pre-Launch Conditions
- No third-party audit certificate claimed: ILIR AI does not claim SOC 2, ISO 27001, or certified GDPR audit completion.
- No contractual SLA: Public uptime or timed deletion SLAs are not in force during the current rollout.
- Automated AI disclosure: All generated responses come from an automated AI system and may be incomplete or incorrect.