Skip to content
LEGIT AIDOCS
Open the console

Security

The controls around the platform, layer by layer.

Five layers of controls around what you are protecting, with the air gap around all of them. Each control listed is in the platform and checked by its tests.

SecurityLayer by layer, around what you are protecting
Air gap: lookups to the internet off unless allowedEdge01Identity02Organisation boundary03Actions04Evidence05

Controls in each layer

01Edge

  • HTTPS for the console and the API
  • Content Security Policy, no inline scripts
  • Rate limits for each address

02Identity

  • Two-factor set up before the first session
  • Passwords hashed with Argon2id
  • Role and status read on every request
  • A fresh code for dangerous actions, used once

03Organisation boundary

  • Every route checked as another organisation, on every test run
  • API keys belong to the organisation

04Actions

  • A second administrator, or one person with a fresh code
  • Agent commands signed; expired or replayed ones refused
  • Every isolation ends by itself
  • Uploads analysed in a memory-capped process

05Evidence

  • Audit log hash-chained, rows cannot be deleted
  • Terminal sessions recorded, encrypted and sealed
  • Update bundles checked file by file

—Air gap

  • Lookups to the internet off unless allowed
  • Never in air-gap mode
Legit AI
  • Boundary
  • Part of the platform

Read more: Facts and evidence, Isolation and process kill, Secure terminal.