Zaati OS is private by architecture, not by a promise printed in a footer.
- normalized personal snapshots
- instance preferences and enabled sources
- source and data-repository credentials
- compiled dashboard assets containing private facts
- deployment hostnames and account identifiers when users consider them sensitive
Users separately trust their selected source providers, LLM provider or local model, private snapshot storage, Git host, CI runner, deployment host, identity provider, and authorized viewers. Zaati OS cannot change a third party's data retention or training terms.
| Threat | Control |
|---|---|
| Personal data committed to a public fork | Separate private data repository, ignored paths, tracked-file privacy scan |
| LLM writes outside its scope | One worker-owned deterministic path, source registry validation |
| Prompt injection requests code or secrets | Allowlisted inputs, forbidden inputs, schemas, no arbitrary rendering |
| Missing data produces a false conclusion | Explicit source status, partial and failed states, warnings, confidence |
| Static bundle served publicly | workers_dev and preview URLs disabled, custom domain behind Access |
| CI exposes data | No private build artifacts, no snapshot logging, secrets only on protected deployment events |
| A broad Access rule lets anyone in | Deny by default, exact emails or constrained identity groups, unauthenticated preflight |
| Credential committed accidentally | Common credential-shape scan, GitHub secret storage, scoped tokens, host push protection |
| Private snapshot repository is copied or leaked | Optional AES-256-GCM authenticated encryption with a separate deployment key |
| Producer returns only part of a batch | Authoritative expected-source comparison rejects missing, extra, or self-redefined bundles |
| Producer self-certifies unsafe output | Base-branch-controlled private-repository validation before merge |
| Sensitive text hides inside a valid field | Universal secret scanning plus source-specific content guards over every snapshot string |
Keep a normalized action, measure, deadline, status, and evidence reference when they are enough. Avoid raw email bodies, full documents, attachments, statements, account identifiers, source code, customer data, authentication links, cookies, tokens, and unnecessary information about other people.
Financial views may retain user-approved account-level totals, normalized holdings, explicit goals, and scenario assumptions. They must not retain account numbers, payment authorization data, complete statements, transaction counterparties, or credentials. A projection must state its assumptions and remain distinct from a verified balance or financial advice.
Zaati detects common credential formats and source-specific risky shapes. No regular-expression list can identify every secret, medical fact, name, message excerpt, or unnecessary personal detail. Enable secret scanning and push protection on the private repository, minimize before the first branch push, and treat model and operator judgment as part of this boundary.
A public fork may contain schemas, prompts, reusable source definitions, UI, and synthetic examples. It must not contain real snapshots, local instance configuration, a compiled private dashboard, screenshots of real data, or deployment secrets.
Client-side hiding is not authentication. Zaati OS keeps personal facts out of the cached application JavaScript, but the authorized browser still receives plaintext dashboard JSON. Protect the entire hostname before deploying private data.
Encrypted snapshot storage is optional and disabled by default. It protects repository and filesystem copies from readers who do not have the separate key and detects ciphertext modification. It does not protect data from an authorized LLM workflow, the build process, the deployed dashboard payload, an authorized browser session, a compromised provider, or a leaked decryption key. Do not give the key to a hosted LLM. Use this mode with trusted local or CI ingestion.
Generate the ignored key with npm run snapshot:keygen. In production, store its value only as the protected ZAATI_SNAPSHOT_KEY deployment secret. Never commit the key beside encrypted files. Back it up securely because Zaati OS cannot recover encrypted snapshots without it.
- Deploy synthetic data only.
- Attach a custom hostname.
- Create a Cloudflare Access self-hosted application.
- Use an exact Allow policy or a constrained identity group.
- Test an authorized session.
- Test an incognito unauthenticated request.
- Run
npm run access:verify -- your.private.hostname. - Install and require the independent private-repository validation check.
- Only then connect the private data repository.