Skip to main content

​
Minimum safeguards

  • Terminate HTTPS at a trusted reverse proxy or load balancer.
  • Configure a long admin password before allowing remote access.
  • Keep the instance on a private network unless public access is required.
  • Store provider credentials in a secret manager or protected environment file.
  • Restrict filesystem access to /app_data and its backups.
  • Expose only the ports required by the selected workflow.
  • Rotate credentials and MCP tokens after suspected exposure.

​
Data flow

Self-hosting the application does not automatically keep presentation content local. Hosted text, image, or search providers receive the content sent to them. Use local providers and disable external integrations when a workflow requires local-only processing.

​
API and MCP

The REST API uses the configured admin credentials when authentication is enabled. MCP uses a bearer token derived from the authenticated session. Protect both behind the same network and TLS controls as the browser application.

Configure authentication

Create, rotate, and recover the self-hosted admin account.