Security documentation pack

ExploreSelf-hostDocumentationBlogSign In
Documentation
Overview
Getting Started
Getting StartedPlatform IntegrationsAgentPlaybooks in ClaudePortable Bot TeamsHermes Memory ProviderHermes for OrganisationsAgentPlaybooks Tools in HermesCLI & Editor PluginsPython SecretsCross-platform Agent BackupsRelease DistributionTeam CollaborationFederated MCP & OpenAPI ToolsMCP Registry PublishingRoadmap
Core Concepts
PlaybooksSkillsMemoryMCP Integration
Reference
ArchitectureAPI ReferenceManagement APIDeveloper GuideSelf-HostingSecurity documentation packOn-prem Backup and RestoreSelf-hosted mTLSEnvironment Setup
View on GitHub
DocsSecurity documentation pack

Security documentation pack

Supplier-assessment and EIR classification pack for self-hosted AgentPlaybooks (NIS2 Article 21(2)(a), (d), (g); 7/2024. (VI. 24.) MK rendelet mapped to NIST SP 800-53 rev. 5 families).

Hungarian is the language of record. Full text lives in the repository (not only on this page):

  • docs/security/README.hu.md — index
  • Whitepaper (HU) · EN
  • Asset inventory (HU) · EN
  • Risk-assessment template (HU) · CSV

In a clone of this tree the same files are under docs/security/.

jogi ellenőrzés szükséges. This page is not legal advice, not a certification, and not an EIR classification. The customer's IBF and counsel must approve every legal interpretation before production use.

What the code actually does (summary)

Verified in source; details and file links are in the whitepaper.

AreaPresentNot present

CryptoAES-256-GCM, HKDF-SHA-256 per-user keys, AAD-bound v2 ciphertextKMS/HSM, re-encryption rotation
TLS / mTLSPlatform TLS on hosted Cloudflare; hosted mTLS via cf.tlsClientAuth; self-host MTLS_MODE=proxy behind a trusted terminator. Done on main: #201Node does not terminate TLS; without a terminator certificate auth stays fail-closed
AuthN / AuthZSupabase Auth; Entra/Google/GitHub/LinkedIn OIDC if enabled; owner\editor; API-key roles including proposerApp-level MFA; SAML; auditor role on main. Folyamatban / In progress: #202
Auditaudit_logs for federation and secret.*; owner read APISIEM/syslog export, retention job, hash chain, skills/memory/canvas writes. Folyamatban / In progress: #202
ExpiryEnforced secret expires_at; API-key expiry; mTLS client revokeBackground purge job
Self-hostDocker app on port 3000; separate Supabase stack required; local Geist woff2 (next/font/local); isolated no-egress CI for the secrets flow (deploy/airgap/). Done on main: fonts #200; CI #204Production compose is still app-only; npm ci / base images pull before isolation; use_secret egress unless destinations are pinned
SDLCDependabot, npm audit:production in CI, CLI npm provenance, CodeQL, CycloneDX SBOM, cosign of SBOM blobs, SECURITY.md, incident runbook, GitHub private vulnerability reporting (no security email), encrypted on-prem backup/restore + empty-machine drill. Done on main: #205, #207, #203Signed container registry publish

Operations checklist: Self-Hosting. Architecture: Architecture.

Keep the live inventory current:

npm run inventory:self-host
npm run docs:check
Edit this page on GitHub
On this page
What the code actually does (summary)