Minimum safeguards
- Terminate HTTPS at a trusted reverse proxy or load balancer.
- Configure a long primary-administrator password before allowing remote access.
- Keep the instance on a private network unless public access is required.
- Store provider credentials in a secret manager or protected environment file.
- Restrict filesystem access to
/app_dataand its backups. - Expose only the ports required by the selected workflow.
- Revoke and replace API keys after suspected exposure.
Data flow
Self-hosting the application does not automatically keep presentation content local. Hosted text, image, or search providers receive the content sent to them. Use local providers and disable external integrations when a workflow requires local-only processing.API and MCP
The REST API and MCP use administrator-generated Presenton API keys when authentication is enabled. Protect both behind the same network and TLS controls as the browser application.Configure authentication
Manage users, recover the primary administrator, and generate API keys.