Start your free Preview

Product

How it worksSee what's realPlay the graphFix it safelyCatch attacksGraphneIntegrations

More

TrustDocsChangelogAboutPressBlogCareersContactStart your free Preview

Trust

Security you can verify.

GraphnAI runs on your own server, and its security documentation is public.

Architecture

Every connection starts inside your network.

Inside your network: domain controllers, the Identity Bridge, the GraphnAI server with its database, and your team's browsers. The bridge reads the domain controllers over LDAPS and dials out to the GraphnAI server over mutual TLS. Your team reaches GraphnAI over HTTPS. Outside your network, GraphnAI reaches Microsoft Entra ID over HTTPS, an AI model only if you configure one, and sends GraphnAI the company a usage report with counts only.Your networkOutsideDomaincontrollersIdentityBridgeGraphnAIserver and databaseYour teamMicrosoft Entra IDAI model you chooseoptional, can be localGraphnAI usage reportcounts, never contentLDAPS 636dials out, mutual TLS 1.3HTTPSMicrosoft Graph, HTTPS
The bridge reads your domain controllers and dials out to your GraphnAI server. Security Architecture has the details.

In practice

What we commit to.

Your identity data stays with you

  • GraphnAI is one bundle that runs on your server, with its own database. We have no standing access to it.
  • It sends us only a usage report, with counts and no account names, domain names, hostnames or IP addresses. Every field is documented, and a build test keeps the list honest.

The bridge only dials out

  • The Identity Bridge opens every connection, so you need no inbound firewall rules, VPN or perimeter network.
  • It uses mutual TLS 1.3, with certificates from a certificate authority inside your GraphnAI.
  • Service account passwords reach the bridge over that connection and stay in its memory, never on disk.

Keys you hold

  • GraphnAI creates its own root key at first start and derives its encryption and session keys from it.
  • Secrets are encrypted with AES-256-GCM before they reach the database. No key is stored there, so the secrets in a stolen backup stay encrypted.
  • API keys are stored only as SHA-256 hashes.

Your sign-in, your MFA

  • Sign in through your own OpenID Connect provider, such as Entra ID or Okta, with its MFA, or against Active Directory over LDAPS without GraphnAI keeping the password.
  • Roles are Viewer, Operator and Admin. Only Admins change configuration or build their own fixes.

Changes you can take back

  • Every change is simulated first, and GraphnAI only runs changes it can reverse.
  • Full-Auto changes roll themselves back if sign-in failures spike afterwards.
  • Each change records who ran it, what it changed and how to undo it.

AI with least privilege

  • Graphne is off until you configure a model, which can be one you run yourself.
  • It reads your graph through its own read-only database account and treats directory text as untrusted data.
  • Stop any answer or investigation, switch AI off for everyone at once, and set a hard spending ceiling. Each answer keeps its evidence.

Support only when you say so

  • GraphnAI Support needs a key you apply to see your deployment. The access is read-only, expires on its own, and you can end it any time.
  • While it’s active, everyone in your organization sees a banner, and each query is logged to the support case.

How we build it

  • Container images are built on minimal Alpine Linux.
  • Every binary records its version and source commit.
  • Third-party build steps are pinned to fixed commits.
Read the details

Documentation

Compliance

Where we are

We're working toward SOC 2 Type II. Because GraphnAI runs on your infrastructure, your existing controls cover the data it holds.

Found something?

Report a vulnerability

Use the contact form and choose "Security Report". We acknowledge every report within 24 hours.

Check it on your own server.

The Public Preview is free for 30 days from your first sync, on your own server.

Start your free Preview