EERRAA // SECURITY
Secrets stay secret.
Here is how EERRAA handles keys, identity, and actions. Facts about how the system works, not badges we have not earned. When something matters to you, you can read the code and host it yourself.
› EERRAA is in beta. This page describes real mechanisms in the software, not a formal certification. If you need a security review, a DPA, or on-prem, talk to us.
HOW IT WORKS
Model keys and every per-user credential are encrypted with Fernet before they touch the database. They are decrypted only in memory, at the moment a tool call needs them.
Per-user credentials are injected into tool auth as placeholders. The raw secret is substituted server-side, at call time. The model sees the placeholder, never the value.
Your model provider key is yours. EERRAA never sees your model spend and never proxies your tokens through a shared account. No working key means chat is refused, not silently rerouted.
Custom tools call out over HTTP through an SSRF guard that blocks internal and link-local addresses, so a crafted tool target cannot reach into your private network.
In signed mode, each user context is HMAC-SHA256 signed over canonical JSON with a fresh timestamp and a 5-minute window. It is tamper-proof, and it gates private uploads, the vault, per-user OAuth, and the tasks panel.
One install runs many agents across many orgs and projects. Data, keys, knowledge, and sessions are scoped per org. Tenants do not see across the boundary.
Tools that change state can require an explicit Approve or Cancel before they fire. The confirmation surfaces in the widget, so nothing destructive happens without a human saying yes.
Per-project rate limits and a per-user chat throttle blunt abuse. A monthly token budget is a hard stop: once it is hit, chat returns a budget error instead of spending more.
AUTH AND PROVISIONING
Remote MCP servers connect over OAuth 2.1 with authorization_code and PKCE. Connect once as admin (shared), or let each end user connect their own account from the widget (per-user).
Credentials can be provisioned from your backend with a signed identity over PUT /v1/credentials. The secret arrives server-side and is encrypted immediately, never exposed to the browser or the model.
LIMITS THAT PROTECT YOU
50 credentials per user, 8 KB per value. Names constrained to a safe character set.
PDF, TXT, and MD only, up to 50 MB, 20 documents per user, processed and scoped per audience.
A signed identity is valid for 300 seconds. Expired or altered signatures are rejected.
The strongest control is ownership.
Self-host EERRAA and every byte stays on your infrastructure.