> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ragen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Data Privacy in Ragen AI: Full Overview

> Understand where your data lives, what leaves your network, and how Ragen enforces access control, audit logging, and prompt safety.

Ragen is self-hosted — your data never leaves your infrastructure unless you explicitly configure it to. Everything Ragen stores (documents, the Postgres database, the Qdrant vector index, conversation history, backups, and encryption keys) runs on infrastructure you control. There is no hosted Ragen offering, and no component reports usage or telemetry back to the vendor.

## Where data is stored

All data lives wherever you install Ragen. Storage is not the complete picture, though: whether document *content* is transmitted to a third party during processing depends on how you configure the model backend.

There is no telemetry channel to the vendor. OpenTelemetry support exists, but it is inert until you point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector you run yourself.

## What leaves your network

Every model call goes where your configuration points it — directly to a provider, or through a proxy you also run ([Model gateway](/configuration/model-gateway)). What leaves your network depends on the destination, not on which path reaches it:

| Configuration                     | What leaves your network                                                        |
| --------------------------------- | ------------------------------------------------------------------------------- |
| Pointed at a locally-served model | Nothing, in normal operation                                                    |
| Pointed at a commercial API       | The prompt: the question plus the retrieved document chunks needed to answer it |

Two things to know before assuming full isolation:

**Document parsing falls back to an off-site service.** `DOCUMENT_PARSER=docling` (the default) parses documents on your own hardware. If Docling fails, the worker falls back to loaders that may send PDFs to an external model. Set `DOCLING_STRICT=1` to fail the ingest instead of falling back. For a deployment that must not transmit documents, this variable is not optional.

**A fully air-gapped deployment takes deliberate work.** The architecture supports it, but running a capable model on your own hardware requires GPU capacity and careful configuration of every service.

## No analytics or vendor tracking

The application reports nothing to the vendor. There is no tag manager, no product analytics, and no usage ping in the Ragen app.

<Note>
  Earlier builds of Ragen included a Google Tag Manager container that loaded on every page of a self-hosted install. This has been fully removed. If you're running an older build, upgrade — there is nothing to configure to opt out in the current version.
</Note>

## Training

Your documents are not used to train or fine-tune any model, and not used to improve the product. Ragen has no training pipeline.

If you route to a commercial API, that provider's own terms govern what they do with prompts. Enterprise tiers of major providers typically offer zero-retention terms — confirm the terms for your specific plan.

## Access control

Ragen enforces two independent role hierarchies: platform-level (installation administrators) and organisation-level (owner / admin / member). On top of that, per-folder and per-file permissions can be granted to individual users or teams.

**The critical detail for any RAG product:** permissions are enforced at retrieval, not only in the UI.

Every indexed chunk carries an `accessible_by` list in its vector-store payload. Non-admin queries apply that list as a filter *before* the vector search runs. Content a user cannot access cannot appear in an answer or a citation.

The common failure mode in other RAG systems is a permission filter on the file list while retrieval searches the whole corpus — the user never sees the document, but receives an answer synthesised from it. Test your own roles before going to production.

**Tenant isolation** is enforced separately. Each organisation gets its own Qdrant collection, and a guard logs any query that touches a tenant-scoped collection without its organisation filter applied.

<Warning>
  SSO (SAML, Entra ID, SCIM) and MFA are not yet built. Authentication today is username/password with per-organisation membership, plus opaque API keys for programmatic access stored non-reversibly in the database.
</Warning>

## Audit and security event logging

Ragen maintains two separate logs.

**Audit log** — records who did what and when, including before-and-after state: document uploads and deletions, permission and role changes, API key creation and revocation.

**Security event log** — covers 21 event types across three severity levels (`info`, `warn`, `critical`) with a handling status. Events include failed logins, brute-force attempts, attempted cross-organisation access, detected prompt manipulation, detected personal data, and rate-limit breaches. Each entry includes the IP address, user agent, and a request identifier.

<Info>
  Neither log has a retention policy or automatic deletion. Rows accumulate in Postgres until you remove them. Both tables hold personal data (IP addresses, user agents, user IDs), so defining and enforcing a retention schedule is your responsibility.
</Info>

<Note>
  Direct export to a SIEM is not yet built. Both logs are queryable in Postgres and through the admin panel. Shipping them to Splunk or Sentinel today means reading those tables or the application's structured logs.
</Note>

## PII detection

Personal data detection via Microsoft Presidio — including Polish recognisers for PESEL, NIP, REGON, ID card numbers and IBAN, which validate checksums rather than only matching a shape — is available and **off unless configured**. Set `PRESIDIO_ANALYZER_URL` and `PRESIDIO_ANONYMIZER_URL`, and start the two containers with `docker compose --profile pii up -d`. Chat fails closed if the analyzer is unreachable, and each organisation chooses what happens to the original. Full detail: [PII masking](/security/pii-masking).

## Prompt injection protection

Document content is treated as data, not as instructions. The system prompt carries an explicit confidentiality rule and is regression-tested against a red-team evaluation suite. The system cites only sources present in the retrieved material and reports when no answer was found rather than constructing one.

## Data ownership

Your documents, the index built from them, and the answers generated from them are yours. Ragen is open source under Apache 2.0. Nothing in the codebase transmits document content anywhere except the model backend you configure.