Security
What Telikos does with your source code.
Telikos runs entirely inside your network. It reads source artifacts from places you choose, never writes to them, and stores what it learns on the appliance. Nothing it holds is sent anywhere else. Every sign-in, question, answer, export, annotation, ingestion and administrative change is written to an audit log.
This page summarizes the Telikos security document. The full document, which names the code and tests behind each statement, and our completed questionnaire answers are available on request from [email protected].
Data flow
- 1Artifacts come in read-only from one of four places: a zip uploaded through the web interface, a Git repository, an SFTP server, or a file-drop directory on the appliance.
- 2Every artifact version is stored in a content-addressed store on the appliance, so answers can always show the exact lines they cite.
- 3Deterministic parsers read the artifacts and produce facts with source locations. Your code is never executed.
- 4Facts go into the graph database on the appliance. Users, runs, answers and the audit log go into a relational database on the appliance.
- 5Optionally, bounded excerpts of facts and cited source lines go to a language model that also runs on the appliance. Its output is kept only where it cites evidence it was given, and it is marked as awaiting expert review.
- 6Users ask questions through the web interface over HTTPS. Answers are composed only from retrieved evidence, and a validator drops any statement that does not cite it.
What leaves your network
Nothing, by construction.
- Every appliance service except the HTTPS proxy sits on a Docker network declared internal, which has no route out. Only the proxy publishes a port: 443.
- The worker can also reach your own Git and SFTP servers so connectors can read from them. You restrict that network to those hosts with firewall rules.
- Telikos refuses a model endpoint outside the local network unless an administrator sets LLM_ALLOW_REMOTE=true. The appliance configuration pins that setting to false. The health page never contacts a refused endpoint, even to check it.
- The web interface loads nothing from other origins. It uses system fonts, and its Content-Security-Policy allows only the appliance's own origin.
- Next.js telemetry is disabled at build and run time.
- Language models are loaded by a short-lived container outside the running appliance, or imported from a file on air-gapped sites. The appliance's model server cannot download anything.
Controls
| Area | Control |
|---|---|
| Network | Internal Docker network with no route out. Only the HTTPS proxy publishes a port (443). |
| Source access | Connectors only read. Git clones are shallow and have their remote removed. Git accepts only https and ssh URLs, with hooks disabled. SSH and SFTP require a pinned host key. A file-drop connector reads only under configured roots. |
| Model endpoints | Endpoints outside the local network are refused unless explicitly allowed. The appliance pins this off. |
| Encryption in transit | HTTPS to users, TLS 1.2 and 1.3 only, with HSTS. Traffic between containers on the internal network is not encrypted. |
| Encryption at rest | Connector credentials are encrypted with Fernet (AES-128-CBC with HMAC-SHA256). Everything else relies on host volume encryption, which we recommend. |
| Credentials | Never returned by the API and redacted from logs and job errors. Git tokens travel in a one-off header, never in the remote URL. |
| Authentication | Local accounts. Argon2id password hashes, at least 12 characters. Generated and administrator-set passwords must be changed at first sign-in. Repeated failed sign-ins are refused for a window and audited. |
| Sessions | A random 256-bit token in an HttpOnly, Secure, SameSite=Lax cookie; the server stores only its hash. Sessions expire after 12 hours by default. Every state-changing request must carry a CSRF token. |
| Authorization | Four roles enforced on the server: viewer, analyst, sme and admin. The interface hides what a role cannot do, but never relies on that. |
| Audit | Every state-changing request, sign-in, question and answer, export, annotation, ingestion, backup and user change. The application cannot edit or delete audit rows. Exportable as CSV for your SIEM. |
| Retention | Kept until you decide otherwise. Model prompts and responses, expired sessions and uploaded zips can be trimmed on a schedule. |
| Backups | One archive with a sha256 manifest, created readable by its owner only. Restore refuses damaged archives. |
| Input handling | Uploads are limited to 500 MB, 5 GB expanded and 200,000 files. Expansion ratios above 200:1 and paths that escape the extraction directory are refused. A virus-scan hook runs before ingestion; no scanner is connected by default. |
| Supply chain | Container images pinned by digest. Dependencies installed exactly from lockfiles. A CycloneDX SBOM of every package and image. Dependency audits run with make audit, and a CI workflow with Trivy scanning is defined. |
| Processes | The API and web containers run as unprivileged users. The bundled model server image runs as root. |
Roles
| Role | Can |
|---|---|
viewer | Read the estate, ask questions, browse maps and the review queue, export answers and entity pages |
analyst | Everything a viewer can, plus upload zips, start ingestion from a connector, cancel jobs |
sme | Everything an analyst can, plus confirm, reject, correct, add relations and write notes |
admin | Everything, plus create connectors, manage users, read the audit log and system health |
Language model use
- The model runs in the appliance. Model names are configuration only.
- Every model call is recorded with the model name, prompt and response hashes, token counts, latency and outcome.
- Summaries and rules written by the model record the agent, prompt version, model and input, and wait in the review queue for an expert.
- The model never writes queries. It chooses from a closed set of templates.
- Telikos does not train models on your data.
- Answers can be composed with no model at all, and everything on this page holds in that mode.
Known limitations
These are true of the current version.
- No single sign-on (OIDC or SAML), no multi-factor authentication and no idle-session timeout yet. Sessions end at their absolute expiry or at sign-out.
- No rate limiting beyond sign-in.
- Data at rest is encrypted only by the host, except connector credentials.
- Traffic between containers is not encrypted.
- The audit log is append-only in the application but not cryptographically chained. Database administrators with direct access could alter it, so ship the CSV export off the appliance if the trail must be tamper-evident.
- The Content-Security-Policy allows inline scripts, which Next.js needs for its bootstrap.
- No virus scanner is connected by default.
- Model images are pulled by name and tag, not pinned by digest.
Questionnaire answers
| Question | Answer |
|---|---|
| Is the product SaaS or self-hosted? | Self-hosted appliance (Docker Compose) inside your network. |
| Does any of our data leave our network? | No. Services have no route out; remote model endpoints are refused by default. |
| Does the vendor have access to our environment? | No. There is no remote access, telemetry or phone-home. |
| Which data is processed? | Source artifacts you provide (COBOL, JCL, copybooks, DDL, CICS definitions) and facts derived from them. No production business data is needed. |
| Is AI used, and where does it run? | Optionally, a local model in the appliance. Answers can be produced without one. |
| Is our data used to train models? | No. Telikos does not train models. It sends bounded excerpts to a local model at inference time only. |
| How are users authenticated? | Local accounts with Argon2id password hashes, secure session cookies, CSRF tokens and sign-in throttling. Single sign-on is not yet available. |
| How is access controlled? | Four server-enforced roles: viewer, analyst, sme, admin. |
| Does the product write to our systems? | No. Connectors only read; Git copies have their remote removed. |
| Can it be deployed air-gapped? | Yes, including models, which are exported and imported with sha256 checks. |
This website
telikos.ai is a marketing site. It is separate from the product and never holds your source code. The product itself has no telemetry and sends nothing to us.
The pilot request form sends what you type to the Nisius team by email and as a Slack message. This site has no database and does not store it.
This site does not load analytics.
Send us your questionnaire
We answer security questionnaires in writing before a pilot starts, along with your reviewer's follow-up questions.