Skip to main content
Suchi stores documents that may contain financial, identity, health, or legal information. The stock application has no telemetry, update ping, remote asset, cloud OCR, or cloud search dependency.

​
Outbound connections

Outbound traffic occurs only when an operator configures or uses an integration: Hosted LLM use requires an explicit egress acknowledgement. Local LLM endpoints do not require that acknowledgement, but they are still network destinations chosen by the operator. Suchi logs a redacted inventory of its managed egress destinations at boot; suchi doctor prints the same inventory without exposing credentials. A pre-consume script is not network-isolated and its destinations cannot be inventoried by Suchi; constrain process or container egress when needed. Classifier question answers are transient. Suchi validates them against the offered ID/answer and current document text, then maps them to fixed local actions. It does not persist question-specific raw answers, evidence quotes, or prompt transcripts. Approval and audit rows retain only bounded automation ID/name attribution, confidence, policy, and the resulting metadata proposal.

​
Encryption

Use TLS at the reverse proxy or configure TLS_CERT_FILE and TLS_KEY_FILE. For storage, full-volume encryption is the recommended baseline because it covers original blobs, derived files, SQLite metadata, FTS text, thumbnails, and generated views together. Suchi seals these database values with AES-256-GCM before storing them:
  • remembered PDF passwords
  • mailbox passwords and OAuth credentials
  • Archive Configuration-managed LLM API keys
The key is generated at $DATA_DIR/.decrypt-key with restrictive permissions. Possession of a database copy alone does not reveal those values. Possession of both the database and key does. API tokens and browser session identifiers are stored as digests. Back up the entire data directory so the database, blobs, and credential key remain a recoverable set. Browser cookies are marked Secure when PUBLIC_URL uses HTTPS. Signing out deletes the current session, revokes the current API token when applicable, and expires the browser cookie. Suchi does not provide application-level encryption for original blobs or SQLite content in v0.1. Use encrypted storage and encrypted off-host backups when the host or backup medium is outside your trust boundary. Filing systems provide application access boundaries, not separate SQLite/FTS databases, CAS stores or encryption keys. Users/groups and model/OCR/server configuration remain shared. Instance administrators and host/backup operators are trusted across systems; a prefix is neither physical isolation nor a compliance claim. Equal bytes may share an immutable CAS object even when their document rows belong to different systems.

​
Logs and audit data

Application logs use identifiers, sizes, states, and hashes rather than OCR or document text. Audit events record metadata changes and request IDs, not document content or plaintext credentials. Health and metrics endpoints expose operational state, not archive content. OIDC accounts store the provider issuer and opaque subject on the users row because that pair is the returning identity key. Retained user.email_changed audit metadata contains the old/new addresses, source, and revoked-browser-session count. Retained user.oidc_bound metadata contains the issuer, email, role, new-user flag, revoked-session count, and SHA-256 of the NUL-delimited issuer/subject pair; it does not copy the opaque subject itself. Both kinds also retain the request ID and numeric account reference. These identity-security rows are excluded from ordinary AUDIT_RETENTION_DAYS pruning. They remain visible to database/backup operators and configured audit sinks until deliberately removed; they are instance-wide, not part of the filing-system Activity feed. Sink delivery remains post-commit/best-effort and is not a tamper-evident ledger. Account-email changes add no SMTP service, recovery mail, old-address notification, or new egress destination. OIDC synchronization contacts only the already configured identity provider through the ordinary authorization flow. HTTP access logs record matched route patterns, not raw paths or query strings; share-link credentials are omitted from audit payloads and downstream sinks. Older builds recorded share bearers in access logs and creation audit records. Review retained copies and revoke affected passwordless shares if those records left the archive’s trusted operator boundary; upgrading does not erase old logs. Unexpected server and LLM-provider failures are sanitized before reaching the UI. A mailbox owner or administrator running Test connection receives the mail provider’s connection or authentication diagnostic so they can repair the account; it is not exposed to other users. Preview matches reads at most 25 unchecked messages using IMAP envelope metadata and attachment filenames, then returns at most five matching samples to the authorized user. Message bodies are not downloaded, persisted, or logged by preview. The LLM connection test returns validated synthetic classification fields and latency, never raw model output or archive text. Ask your documents is read-only and transient. Suchi stores no conversation rows, and the browser retains at most the 20 newest turns while the application is mounted. The server finds only non-trashed documents in the current filing system that the user may enter and open. Switching systems destroys the browser conversation and invalidates late responses. When sensitive consent is off, only unset, Public, and Internal documents are eligible; unknown sensitivity values fail closed. Confidential and Restricted documents require the per-conversation option. Clear, document-context or model changes, and turning that option off clear the relevant in-memory history. The drawer identifies the local model or hosted model service receiving document text. The administrator-owned Reading depth preset changes the maximum authorized text sent per question, which can affect provider cost, latency, and privacy exposure. See Ask your documents: Reading-depth presets for the exact bounds and fallbacks. The model receives document text as explicitly untrusted data and has no tools or actions. Previous assistant answers provide continuity but never become document text. Only documents linked from the prior answer are checked and reloaded in their requested order. Before rendering, Suchi checks the answer JSON and verifies that its numbered links refer to supplied documents. It does not judge whether every written claim is correct. Suggested details are persistent archive metadata rather than conversation history. They retain a bounded quote, extractor version, review state, and a reviewer when a person made the decision. With Apply when confident enabled, new dates at or above the configured threshold can feed Calendar, rich queries, and later answers without human review; Review first leaves them pending. Existing decisions remain unchanged, and saving settings does not bulk-accept pending dates. Logs never include questions, answers, titles, document text, or extracted quotes. The question-assembly event contains only the selected reading-depth mode, matching-section count, document count, and bounded text size. Separate access logs contain the HTTP method, path, status, byte count, duration, and request ID; hosted-model egress events contain the provider host and model name. Sanitized failures may also be recorded.

​
Deletion and retention

Deleting a document first moves it to Trash, where it remains recoverable for 30 days. Suchi purges expired Trash at startup and daily; confirmed permanent deletion can remove one document or empty the caller’s Trash sooner. A purge removes document-owned database state, revokes share links containing the document, and removes rendered files. Original and derived CAS bytes remain on disk until the operator runs offline garbage collection with all archive writers stopped. Database snapshots and external backups may retain deleted data until their separate backup lifecycle expires. Retained identity events and user issuer/subject bindings are account-security metadata, not document-owned data. Document purge and ordinary audit retention do not remove them. Whole-directory snapshots and external backups may retain both current and historical addresses according to their separate lifecycle. Share links are random, revocable bearer tokens containing documents from one system. A Network link uses the normal Suchi origin; a Public link uses an optional share-only internet ingress and must expire within one year. Recipient requests recheck that the creator is active, can still enter that system and can still share each live document. Removing membership revokes that user’s system shares, API tokens and pending mobile pairings; re-admission does not revive them. Revocation stops future access but cannot retract downloaded bytes.

​
Operator checklist

  • Restrict host and DATA_DIR access.
  • Use TLS and an accurate PUBLIC_URL.
  • Encrypt the volume and off-host backups where required.
  • Protect .decrypt-key, API tokens, and provider credentials.
  • Enable only the integrations whose egress you accept.
  • Test restore and deletion procedures before relying on them.
See Backup and restore, Configuration, and Security policy.