Book 4
Security Documentation
OPSQAI keeps the employee product and operational knowledge inside the customer-controlled Windows environment, with explicit identity, access and entitlement boundaries.
1. Data boundary
Customer documents, embeddings, conversations and operational records belong to the Self-Hosted installation. Management Center and Customer Portal support licensing, distribution and support; they are not operational-data workspaces.
2. Authentication
Local users authenticate against the installation. Passwords use Argon2id; sessions are signed and validated before protected application functions run.
3. Roles and module access
SuperAdmin has full administrative access and can create additional SuperAdmins, while last-SuperAdmin protection prevents accidental lockout. Other users receive a role and explicit module access. License entitlement and role authorization are separate checks and both must pass.
4. License security
License bundles are Ed25519-signed JWTs. Self-Hosted validates the signature locally before preview and activation. Invalid, expired or missing entitlements never unlock products.
5. Audit and accountability
Administrative and license operations are recorded in the installation's audit surfaces. AI Audit and source-grounded answers give operators visibility into knowledge use without moving operational content into OPSQAI Cloud.
6. Backup and recovery
Administrators are responsible for protecting local application data and backup material according to company policy. OPSQAI health and diagnostic tooling helps identify service, storage and database readiness issues.
7. Security contact
Report suspected vulnerabilities to security@opsqai.de. Release and remediation information is distributed through the customer support and release channels.