Claims you can verify.
Not policies. Architecture. Each guarantee below is enforced by how BodhAI is built — expand a claim to see the mechanism.
Files are encrypted client-side with AES-256-GCM before they ever leave your browser. Only your local server holds the key that can decrypt them. We could be compelled to hand over everything we store, and it would still be unreadable.
Enforced by: Client-side AES-256-GCM encryption — decryption key never transmitted.Our relay validates your access token and forwards encrypted bytes between your local server and ours. It never buffers, logs, or inspects the content passing through it — it physically cannot read what's inside.
Enforced by: TLS-tunnelled WebSocket relay — no content-layer parsing, buffering, or logging.Every connection between your local server and our relay is mutually authenticated. A leaked access token alone is not enough to establish a connection — the client certificate is required on both ends.
Enforced by: mTLS — org-specific client certificates, validated on every connection.Access tokens are RS256-signed JWTs, issued by our cloud but verified entirely offline against a public key — no per-request cloud call, and your server keeps answering even if our cloud is down. Any token that leaked would still be unusable within a quarter of an hour.
Enforced by: RS256 signature, verified offline · 15-minute access-token expiry.Operational metrics are schema-limited: counts, latencies, model name, and your org ID. Query text is never included — not even loosely — only a SHA-256 hash of it. Bug reports pass a local NER + regex scrubber before anything unscrubbable is allowed to leave your machine.
Enforced by: Schema-limited events · hash-only queries · local PII scrubber (NER + regex).Large uploads transit S3 already encrypted client-side, and are permanently deleted by a 24-hour lifecycle policy regardless of anything else that happens — the safety net underneath the encryption.
Enforced by: Client-side AES-256-GCM + 24-hour S3 deletion lifecycle policy.Local mode
- Documents, models, and answers run on your hardware
- Runs fully on-premise — your data never leaves your server
- Original files are never deleted — full data portability
- Group-based access, enforced locally at retrieval time
Cloud mode — in development
- Same guarantees, hosted single-tenant
- Region-pinned deployment
- Customer-held encryption keys
- Documented before launch, audited after
Responsible disclosure
Found a vulnerability? Use the contact form and choose Security as the purpose — it routes straight to the team. We acknowledge every report within 48 hours and credit researchers who report responsibly.