Security that runs on every request
KnowledgeHub AI checks who you are, which organization you belong to, and what your role allows before it reads a single row. Here is exactly how your workspace is protected.
GET /organizations/:id/documents- Signed-in sessionHttpOnly session cookie, CSRF token on changesChecked
- Organization membershipNon-members are rejected before any data is readChecked
- Role permissionOwner, Admin, Member, or ViewerChecked
- Workspace-scoped queryReads only this organization's recordsChecked
Only your organization's documents are returned
Every organization is its own vault
An organization ID in the URL is never trusted on its own. The API confirms your membership, then scopes every query for documents, search, answers, and conversations to that organization.
Your workspaceChecked
128 documents
- Customer onboarding guide.pdf
- Contract policy.pdf
- Success team handbook.docx
Another organizationBlocked
Access denied: not a member
Roles decide what each person can do
Give people the least access they need. Viewers can read and ask questions, Members manage documents, Admins manage people, and Owners control the organization itself.
| Capability | Owner | Admin | Member | Viewer |
|---|---|---|---|---|
| View, search, and ask questions | Allowed | Allowed | Allowed | Allowed |
| Keep conversations private to yourself | Allowed | Allowed | Allowed | Allowed |
| Upload, rename, and delete documents | Allowed | Allowed | Allowed | Not allowed |
| Invite people and change their roles | Allowed | Allowed | Not allowed | Not allowed |
| Rename the organization and view insights | Allowed | Allowed | Not allowed | Not allowed |
| Manage owners and delete the organization | Allowed | Not allowed | Not allowed | Not allowed |
Files never sit behind a public link
Documents live in private object storage. Your browser receives a signed link that works for one file and expires shortly after, and every upload is verified before it is processed.
- 1
Signed upload link
Issued for one file and expires after 15 minutes by default.
- 2
Content verification
File signature, content type, and a 10 MB size limit are checked. Mismatches are rejected.
- 3
Safe extraction
Text is extracted with limits on size, including limits on DOCX archives.
- 4
Short-lived downloads
Opening a source creates a fresh signed link for members only.
- DOCX
- Markdown
- TXT
- ≤ 10 MB
- 15 min
Accounts and sessions
Sign-in is designed to resist stolen cookies, password guessing, and cross-site requests.
Argon2id password hashing
Passwords are never stored, only memory-hard hashes.
HttpOnly cookies
Session tokens are unreadable from page scripts.
CSRF protection
State-changing requests require a matching token.
Short-lived access
Access tokens last 15 minutes. Sessions can be revoked on sign-out.
Rate limits
Sign-in, registration, and search are throttled.
Hardened headers
Security headers and a strict CORS allowlist on the API.
A record of who changed what
Admins and Owners can review an audit log of membership and document changes, so nothing important happens silently.
- MRChanged Dana Ortiz to Admin
- DOUploaded Security policy.pdf
- MRInvited sam@northwind.dev as Viewer
- JLDeleted Old pricing.docx
AI answers stay grounded in your workspace
When you ask a question, KnowledgeHub AI retrieves passages from your organization only and sends those passages to OpenAI to generate the answer.
- Retrieval is limited to the organization you are working in
- Every answer links back to the source passages it used
- Conversations are private to the person who started them
Found a security issue?
Tell us privately and we will look into it right away. Please include steps to reproduce.