Security
Security and deployment overview.
Mission LLM runs inside your boundary. This page covers where data goes, which controls ship today, which are in development, and how to harden an install.
Last updated
Mission LLM does not hold any government certification or authorization today. Because it runs on your infrastructure, you assess it as part of your own system.
Data flow in plain language
Your network
Mission LLM serverStays on your server
- Uploaded documents and the text parsed from them.
- Embeddings, when you use the built-in embedder and the built-in LanceDB store.
- Chat history, workspaces, users, API keys and the event log, in a SQLite database in your storage volume.
All of it lives in the storage directory you mount, so your existing backup and encryption-at-rest controls apply.
Leaves only when you configure it
- Cloud language model: the question, recent chat history and retrieved passages go to that provider.
- Cloud embedding engine: document text goes to that provider to be embedded.
- Hosted vector database: vectors and passage text are stored with that service.
- Agent skills, MCP servers and data connectors: each contacts the service you point it at, such as a search provider, a database or a Git server.
The Privacy and Data page in Settings shows how each configured provider handles your data.
Other outbound connections
| Connection | When | What is sent | How to avoid it |
|---|---|---|---|
| Telemetry (the upstream project's analytics account) | On boot and during use, unless disabled | Anonymous usage events, such as which provider types are selected | Set DISABLE_TELEMETRY="true" before the first start |
| models.dev | At boot, when the pricing cache is missing or older than three days | A request for public model pricing data | Block it. The server logs the failure and keeps running. |
| raw. | At boot, when the context-window cache is missing or stale | A request for public model context-window data | Block it, and set token limits for local models in their provider settings |
| Hugging Face, then cdn.anythingllm.com | First use of the built-in embedder or reranker | A model file download | Stage the models under storage/models |
| Hugging Face | First local audio transcription | A Whisper model download | Stage the model under storage/models |
| OCR language data | First OCR of an image or scanned PDF | A language data download by the OCR library | Stage the data under storage/models/tesseract |
| Community Hub (hub.external. | Only when an admin browses or imports items | Browse and import requests | Do not open the Community Hub pages |
| Onboarding survey (onboarding. | Only if someone fills it in and submits it, from their browser | The email, use case and comment entered | Leave the survey blank |
In developmentAn offline mode switch that turns all of these off at once is in development.
Controls available today
Access
- Authentication:
- a single password, or multi-user mode with individual accounts. You choose during onboarding.
- Roles:
- admin, manager and default. Default users chat only in the workspaces they are assigned to.
- Account controls:
- invitations, suspension and per-user daily message limits.
- Password complexity:
- minimum and maximum length and required character types, set with
PASSWORDMINCHAR,PASSWORDREQUIREMENTSand related variables. - Simple SSO passthrough:
- sign users in with temporary tokens issued through your own identity bridge (
SIMPLE_SSO_ENABLED).
Oversight
- Admin event log:
- sign-ins, failed sign-ins, attempts on suspended accounts, changes to users, invites and API keys, workspace and document changes, and chat exports.
- Chat history export:
- CSV, JSON or JSONL.
- Hide chat history
- from the interface:
DISABLE_VIEW_CHAT_HISTORY. - Workspace deletion protection:
WORKSPACE_DELETION_PROTECTION.
Transport and runtime
- Built-in HTTPS
- with your certificate and key (
ENABLE_HTTPS,HTTPS_CERT_PATH,HTTPS_KEY_PATH), or TLS at your own reverse proxy. - The container runs as a non-root user
- (UID 1000 by default) and has a health check.
- The Helm chart
- keeps credentials in Kubernetes Secrets and ships with telemetry off.
- Telemetry off with one setting.
- Set
DISABLE_TELEMETRY="true"and no usage events are sent.
Integrations
- Developer API:
- admin-issued API keys, OpenAPI documentation at
/api/docs, and OpenAI-compatible endpoints. - Agent tools:
- admins turn each agent skill and MCP server on or off.
Hardening an install today
Set
DISABLE_TELEMETRY="true"before the first start.Set a password or turn on multi-user mode before anyone else can reach the server. Without either, anyone who can reach the address can use the instance.
Publish port 3001 only on the interface you intend. Put TLS in front of it with
ENABLE_HTTPSor your reverse proxy.For disconnected use, choose local providers for chat, embeddings and vector storage, and stage the built-in models under
storage/models.Set password complexity rules.
Keep provider keys and secrets out of shared configuration. In Kubernetes, use Secrets.
Mount storage on a volume that your backup and encryption controls already cover.
To accept connections from the host machine only, bind the published port to loopback in Docker:
-p 127.0.0.1:3001:3001.
In development
These items are not in the current release. They move to ‘Available today’ only when they ship. Dates are not published.
Identity and access
In development- Single sign-on with OIDC and SAML 2.0, with group-to-role mapping.
- SCIM provisioning and deprovisioning.
- Smart card (PIV and CAC) sign-in.
- Multi-factor authentication (TOTP) and revocable sessions with idle timeout.
- Permission-based roles, workspace-level roles and groups.
- Sign-in protection and a lockout policy.
- A system use notice at sign-in and a configurable classification banner.
Audit and oversight
In development- An attributable, tamper-evident audit trail with syslog, webhook and file forwarding.
- Filterable, exportable event logs with a retention setting.
- Usage and cost reporting with budgets.
Data protection
In development- An encrypted secrets store.
- API key scopes, expiry and rate limits.
- Model policy: provider allow-lists, local-only workspaces, and redaction before external calls.
- Agent tool policy: tool profiles for each workspace and one approval policy.
- Retention rules, legal hold and scoped eDiscovery export.
- Backup and restore.
Disconnected operations
In development- An offline mode switch and an outbound connections report.
- Telemetry off by default.
- A model mirror setting for internal model hosting.
- An offline distribution kit with signed release bundles.
Hardening
In development- Hardened HTTP defaults.
- A loopback-only listen address for the server and the document processor.
Answer quality
In development- Strict grounding in Query mode, inline citations with page references, and hybrid keyword and vector search.
Accessibility
In development- A Section 508 and WCAG 2.2 AA conformance pass.
What we do not claim
- Government certification or authorization
- None held today.
- Assessment
- Mission LLM runs on your infrastructure, so you assess it as part of your own system.
Reporting a vulnerability
Report suspected vulnerabilities privately throughGitHub private vulnerability reporting on the Mission LLM repository. The report stays private until a fix is released. Please do not open a public issue.