Security and the trust boundary
Your server is the line. See what stays inside it, what crosses it by choice, and what is not a shipped guarantee yet.
Your server is the line.
Nautilo replaces one giant co-tenant backend with infrastructure controlled by a real organization: your family, team, lab, studio, or circle. That radically shrinks the trust surface. It does not make every model call local, turn an approval dialog into encryption, or make unfinished cryptography a shipped guarantee.
Inside your server boundary
- Claimed organization serverAvailable
A server has a real owner and explicit setup states; an unclaimed instance is not treated as ready.
- Operator-controlled credentialsAvailable
The operator chooses and supplies model-provider credentials instead of inheriting a mandatory Nautilo model backend.
- Scoped action approvalsAlpha
Tool actions can ask for once, Room, server-wide, or deny decisions and show network destinations when present.
Crosses the boundary by choice
- Remote model inferencePartial
When you choose a hosted model, the provider receives the input needed to answer. Providers are not equally private.
- Approved network and app actionsAlpha
An Agent may act through an approved tool or network destination. The approval scope is part of the decision.
Direction, not today's guarantee
- End-to-end encrypted Nautilo data pathIn progress
Product-wide end-to-end encryption is still in progress and is not yet a guarantee for every message and artifact.
- Federation between private serversPlanned
Private organizations connecting without collapsing into one shared backend is direction, not current operation.
- Models on hardware you controlPlanned
Local and on-prem model execution is part of the sovereignty path, not a supported launch workflow.
Today, organization data and operator-controlled credentials live inside a claimed Nautilo server. Hosted model inference and approved third-party actions cross that boundary by explicit choice. Product-wide end-to-end encryption is in progress; federation and local-model deployment are planned and are not current guarantees.
What you can rely on now
Check the controls on your Server
In Desktop or the web Workbench, open the security-posture badge in the footer. It shows Security posture, including Mode, Level, Network, Backend, writable/read-only paths, and your capabilities. Administrators with the relevant capability can also use Server admin → Security → Manage server posture.
Read this as the effective sandbox and approval policy, not an encryption certificate. Change posture requires security-management authority and protected confirmation; ordinary users should ask their administrator rather than weaken a policy to make a failed tool run.
Uncontained host commands is especially consequential: Server policy alone does not activate it. A separately granted Human must confirm it in their own Desktop session. When active, commands can run as that Mac account; Current Folder is not a security boundary. Do not enable it as routine troubleshooting.
Administrators: read posture and audit evidence
These are read-only commands in the signed administrator CLI. Replace the profile with the intended Server's profile, sign in as yourself, and verify your identity before reading evidence:
nautilo login --profile circle-server
nautilo whoami --profile circle-server --format json
nautilo security posture show --profile circle-server --format json
nautilo security audit --profile circle-server --limit 50 --format jsonAudit access requires view_audit_log. In the Workbench, Server admin → Audit
log provides Time window, Actor ID, and Event kinds filters. The
posture dialog's View audit log is another entry point when permitted.
A missing control or capability_denied is not permission to bypass the check.
For CLI audit output, inspect page.complete, hasMore, and nextCursor.
Continue with the returned --cursor and the same filters, or use --all --format jsonl for a larger result. A JSONL stream is complete only after a
successful end record with complete: true; an error/partial record is not a
complete export. If continuation becomes stale, restart the query from its
first page. No events in a selected window is not proof that nothing happened.
Collect the time, error code, relevant event kind and correlation ID where available. Even redacted audit output may identify people, Rooms, commands, paths, or network destinations. Review it privately before sharing the minimum needed excerpt; never attach tokens, passwords, PINs, recovery codes, complete claim URLs, or raw secret-bearing logs.
Encryption: scope matters
HTTPS protects a connection; approvals authorize actions; an encrypted recovery bundle protects that bundle. None alone means that every stored record, message, artifact, cache, notification, export, backup, or model-processing path is end-to-end encrypted.
| Boundary | What to check | What it does not prove |
|---|---|---|
| Client ↔ public Server | Expected HTTPS hostname and valid certificate; remote TLS setup | Encryption at rest, model-provider privacy, or universal end-to-end encryption |
| Same-machine / LAN HTTP | Local deployment or the separate LAN constraints | Transport confidentiality on a network; LAN HTTPS is not currently supported |
| Tools and workstation | Effective posture, capabilities, approvals, and the connected computer's authority | That permitted commands are harmless or that Current Folder contains an uncontained session |
| Stored data and protected content | The exact deployed release, feature support, and encryption coverage—not merely a healthy Server | Blanket protection of every database field, file, cache, or notification |
| Backups and exports | The named Compose bundle or Railway recovery configuration, plus independent custody | That ordinary exports or all backup formats are encrypted, or that lost keys can be reconstructed |
| Hosted models and connected services | The chosen route, provider configuration, and that provider's own policies | That data remains only on your Server after you request a third-party action |
The source maintains an encryption coverage inventory. It still records unresolved coverage across multiple surfaces and blocks applicable whole-product claims. Some protected-content paths exist; this page does not certify them collectively or promise recovery of lost encryption keys. Hosted model calls and third-party tools can receive the material needed for the requested work. Choose those providers and actions deliberately.
For lost credentials, use password, PIN, and recovery codes. For a missing control or denied action, use the role-specific troubleshooting guide. Do not reset a database or disable protection to make encrypted content readable.
Report suspected security exposure privately to the responsible Server administrator. For a Nautilo vulnerability, use the private security reporting page to contact the maintainers. Do not post exploit details, real credentials, or private data to a public issue.