What is locked, what we can reach, and how you close it.

Locked by default

Every brain starts with these on, before it answers a single request.

• SSH by key only. Password login is off, with modern ciphers only (curve25519, chacha20-poly1305, ed25519).
• Automatic bans. Repeated failed logins get the address banned.
• Firewall. Everything incoming is denied except ports 22, 80 and 443.
• Containers on localhost. The only public door is the TLS proxy in front of your console.
• Kernel hardening. SYN cookies, reverse-path filtering, no source routing, no ICMP redirects.
• A password on the console, random per brain and never reused, and a key on the API.
• Untrusted input stays untrusted. Uploads are scanned for prompt injection, risky ones are quarantined, and anything from outside is marked as data, not instructions.

Nothing happens without your yes

The model never runs an action that changes something on its own.

It proposes; you see a card with the platform, the action and the target, and press Send or Cancel. Send issues a permit that is signed, single-use, bound to those exact details and short-lived.

Before the action runs, its arguments are checked for secrets or private content leaving the box.

Every step is logged: proposed, approved, denied, executed, refused. Permits are recorded in a hash chain, so that record cannot be edited quietly.

What stays on your server

• Your chats and documents. In the database on your server. Nothing is copied to us.
• Your model keys. Stored on your server. Your brain calls your provider directly.
• Your usage. No telemetry and no analytics. We do not know what your brain knows or how often you use it.

Passwords and tokens for connected services are encrypted on disk. Chats and documents are not encrypted at rest: anyone with root on the server can read them. That is why the next section matters.

What we can reach

We would rather tell you than market around it. Three doors exist by default, and you can close each one.

1. The name. We run the names under brainfoundry.ai, so we could remove yours. To close it, point a domain you own at your server.

2. SSH. Our setup key sits in the server's authorized keys, so we can update it, back it up, and help if you lose your own key. To close it, remove our key from the server; your setup record says which line it is. After that only your key opens the server.

3. The server account. Brains we run live in our Hetzner account, so we could stop the machine. To close it, we move your brain to a server on your own Hetzner account, from your export.

Closing a door has a cost. With the SSH door closed, we cannot recover a brain whose owner lost their key, and updates and backups become yours to run.

Leaving

One button exports everything except secrets as a single file.

You can move to another model at any time, or run the same software yourself, without us.

Open source

Every line your brain runs is public at github.com/hbar-systems/brainfoundry-nous, along with its threat model. Read it, or have someone you trust read it.

Found something?

Write to hello@hbar.systems with the subject "Security disclosure". We reply within 48 hours, we will not threaten you for finding things, and we credit you, with your permission, once it is fixed.