Outbound connections
Outbound traffic occurs only when an operator configures or uses an integration:
Hosted LLM use requires an explicit egress acknowledgement. Local LLM endpoints
do not require that acknowledgement, but they are still network destinations
chosen by the operator. Suchi logs a redacted inventory of its managed egress
destinations at boot;
suchi doctor prints the same inventory without exposing
credentials. A pre-consume script is not network-isolated and its destinations
cannot be inventoried by Suchi; constrain process or container egress when
needed.
Encryption
Use TLS at the reverse proxy or configureTLS_CERT_FILE and TLS_KEY_FILE.
For storage, full-volume encryption is the recommended baseline because it
covers original blobs, derived files, SQLite metadata, FTS text, thumbnails,
and generated views together.
Suchi seals these database values with AES-256-GCM before storing them:
- remembered PDF passwords
- mailbox passwords and OAuth credentials
- setup-managed LLM API keys
$DATA_DIR/.decrypt-key with restrictive permissions.
Possession of a database copy alone does not reveal those values. Possession of
both the database and key does.
API tokens and browser session identifiers are stored as digests. Back up the
entire data directory so the database, blobs, and credential key remain a
recoverable set.
Browser cookies are marked Secure when PUBLIC_URL uses HTTPS. Signing out
deletes the current session, revokes the current API token when applicable, and
expires the browser cookie.
Suchi does not provide application-level encryption for original blobs or
SQLite content in v0.1. Use encrypted storage and encrypted off-host backups
when the host or backup medium is outside your trust boundary.
Filing systems provide application access boundaries, not separate
SQLite/FTS databases, CAS stores or encryption keys. Users/groups and model/OCR/server
configuration remain shared. Instance administrators and host/backup operators are
trusted across systems; a prefix is neither physical isolation nor a compliance claim.
Equal bytes may share an immutable CAS object even when their document rows belong
to different systems.
Logs and audit data
Application logs use identifiers, sizes, states, and hashes rather than OCR or document text. Audit events record metadata changes and request IDs, not document content or plaintext credentials. Health and metrics endpoints expose operational state, not archive content. HTTP access logs record matched route patterns, not raw paths or query strings; share-link credentials are omitted from audit payloads and downstream sinks. Older builds recorded share bearers in access logs and creation audit records. Review retained copies and revoke affected passwordless shares if those records left the archive’s trusted operator boundary; upgrading does not erase old logs. Unexpected server and LLM-provider failures are sanitized before reaching the UI. A mailbox owner or administrator running Test connection receives the mail provider’s connection or authentication diagnostic so they can repair the account; it is not exposed to other users. Preview matches reads at most 25 unchecked messages using IMAP envelope metadata and attachment filenames, then returns at most five matching samples to the authorized user. Message bodies are not downloaded, persisted, or logged by preview. The LLM connection test returns validated synthetic classification fields and latency, never raw model output or archive text. Archive research is read-only and transient. Suchi stores no conversation rows, and the browser retains at most the 20 newest transcript turns while the application is mounted. The server retrieves only non-trashed documents in the captured filing system that the caller may enter and view. Switching systems destroys the browser conversation and invalidates late responses. When sensitive consent is off, only unset, Public, and Internal documents are eligible; unknown sensitivity values fail closed. Confidential and Restricted documents require the per-conversation option. Clear, scope or provider changes, and turning that option off clear the relevant in-memory history. The drawer identifies the local or hosted endpoint receiving evidence. The administrator-owned Research context preset changes the maximum authorized source text sent per question, which can affect provider cost, latency, and privacy exposure. See Archive research: Research context presets for the exact bounds and fallbacks. The model receives source text as explicitly untrusted evidence and has no tools or actions. Previous assistant answers provide continuity, never evidence. Only actually cited follow-up source IDs are reauthorized and reloaded in their requested order. Before rendering, Suchi checks the answer JSON and verifies that its citation numbers refer to supplied sources. It does not judge whether each written claim is correct. Extracted fact candidates are persistent archive metadata rather than chat history. They retain bounded evidence, extractor version, review state, and a reviewer when a person made the decision. Only dates added automatically or approved in Approvals feed Calendar, rich queries, or later research context. Logs never include questions, answers, snippets, or extracted evidence. The archive-evidence assembly event contains only the selected context mode, passage count, source count, and bounded evidence size. Separate access logs contain the HTTP method, path, status, byte count, duration, and request ID; hosted-model egress events contain the provider host and model name. Sanitized failures may also be recorded.Deletion and retention
Deleting a document first moves it to Trash, where it remains recoverable for 30 days. Suchi purges expired Trash at startup and daily; confirmed permanent deletion can remove one document or empty the caller’s Trash sooner. A purge removes document-owned database state, revokes share links containing the document, and removes rendered files. Original and derived CAS bytes remain on disk until the operator runs offline garbage collection with all archive writers stopped. Database snapshots and external backups may retain deleted data until their separate backup lifecycle expires. Share links are random, revocable bearer tokens containing documents from one system. Public requests recheck that the creator is active, can still enter that system and can still share each live document. Removing membership revokes that user’s system shares, API tokens and pending mobile pairings; re-admission does not revive them. Revocation stops future access but cannot retract downloaded bytes.Operator checklist
- Restrict host and
DATA_DIRaccess. - Use TLS and an accurate
PUBLIC_URL. - Encrypt the volume and off-host backups where required.
- Protect
.decrypt-key, API tokens, and provider credentials. - Enable only the integrations whose egress you accept.
- Test restore and deletion procedures before relying on them.