Security
How vitrinka protects what you put into it — written for the reviewer who has to sign off on a deployment.
What this tab is
This section covers storage, encryption, workspace isolation, access, retention and recovery. Application controls depend on your configuration; hosted-service details are identified separately. The settings are in the configuration reference, and maintenance commands are in Operations.
The public security overview is the technical-measures annex of the hosted service's data processing agreement. This tab is the self-hosted deployment's counterpart: the same controls, described at the level of an environment variable and a command.
The map
| Page | What it covers |
|---|---|
| Encryption and keys | The per-workspace envelope, the deployment key, what is sealed, and how the key is rotated. |
| Storage and tenancy | One SQLite file and one object prefix per workspace, the blob backends, the cache, malware scanning. |
| Backups | The sealed backup archive, what it includes and excludes, and how a restore refuses to overwrite. |
| Retention and deletion | Session retention windows, control-plane rules, and crypto-shredding a workspace. |
| Audit trail | One append-only table, written in the same transaction as the action it records, and its signed export off the host. |
| Identity and access | Roles, credentials, share links, single sign-on, MFA, break-glass, deployment authority, sessions, and how agents authorize. |
| Recorder redaction | One policy applied in the browser and again at ingest, and where key-based scrubbing stops. |
| Headers and CSP | The header set on every response, the single owner of the content security policy, cross-origin access, and the share origin. |
| Air-gapped deployment | What AIR_GAP=1 blanks, what deliberately stays, what leaves the host, and the offline bundle. |
| Licensing | The vendor-signed licence file, verified offline, what it gates, and how expiry degrades. |
Three facts to carry into a review
- Isolation is physical. A workspace is its own database file and its own object-storage prefix; a query has no shared table to cross, and a token is checked against the workspace it addresses before it reaches one.
- Ciphertext is the storage contract. Every blob, and the content columns listed under Encryption and keys, is sealed under the workspace's own key before it reaches disk or object storage; the provider, the blob cache and the backup archive hold ciphertext. The rest of the database rests on volume encryption.
- Nothing here needs the internet. The licence verifies offline against the vendor key built into the server; single sign-on, mail, the trackers and the CLI's update feed all have an in-network shape; and
AIR_GAP=1blanks what does not.