Legal · updated 16 October 2026
Security is shared: we harden the software, you control the server, the keys and the network.
Four containers on an internal network: nginx (TLS edge), the Node.js API, PostgreSQL and Neo4j. Only ports 80 and 443 are published; the databases are reachable only from the API container.
JWT access tokens with rotating refresh tokens, scrypt password hashing, role-based checks (user, admin, owner) on every administrative route, and suspension that revokes outstanding refresh tokens immediately.
Message bodies and previews are sealed with AES-256-GCM; searchable tokens are HMAC blind indexes. You hold the master key, so rotating it is a documented operation you control.
TLS 1.2/1.3 with HSTS, modern ciphers, OCSP stapling and automated Let's Encrypt renewal. HSTS preload is available for production domains.
UFW denies inbound traffic by default, fail2ban watches SSH, unattended-upgrades applies security patches, containers run with no-new-privileges, and the API image runs as a non-root user.
Per-IP and per-user rate limits, stricter limits on authentication endpoints, upload size and type allow-lists, and per-plan storage quotas.
The deployment ships a backup script for PostgreSQL and Neo4j with retention. Keep backups off the host. Verify restores quarterly. Support: support@intranetos.com.
Email support@intranetos.com with the subject "security" including a reproduction path. We acknowledge within 24 hours, keep you informed until the fix ships, and credit reporters who ask to be named.
Questions about this document: support@intranetos.com · +2 01001945390 · graphflow.intranetos.com
graphflow.intranetos.com