Security
Security posture, described honestly
The controls below are real capabilities of the product. Where we're early, we say so — we'd rather be trusted than impressive.
Controls
What protects your knowledge
Verified by automated tests and release evaluation — and sourced from the product manifest.
Encrypted credentials
Connector credentials and the names of people in imported records are encrypted in the database; secrets are never returned in answers or API responses.
Privacy Levels (L1/L2/L3)
Work-order and maintenance history becomes answerable without exposing who did what, unless you decide otherwise.
Tenant isolation
Each customer workspace is isolated; knowledge is never shared across tenants.
Audit logs
Security-relevant actions are recorded in an audit trail.
Human approval gate
Automation you can defend in an audit — a person owns every outbound artifact.
Answer safety
Beyond infrastructure controls, Haryts is designed so answers are safe to rely on: retrieval runs before generation, document answers show their sources, and the system refuses rather than guesses when the evidence isn't there. Secrets and credentials are never returned in answers.
Data isolation
Each customer workspace is isolated: every query is scoped to your organization, and knowledge is never shared across customers.
Account & perimeter security
Sign-in supports optional two-factor authentication (TOTP) and passwords are hashed. Attack traffic is filtered at our server's edge and again in the application; sign-in itself is rate-limited to resist brute-force attempts. Administrative actions are limited to administrators and rate-limited. Security issues can be reported to contact@haryts.com.
Secrets & credentials
Provider credentials and secrets are never returned in answers or API responses, and are stripped from audit logs.
Audit trail & personal data
Security-relevant actions are recorded in an append-only audit log. Optional Privacy Levels control how personal names from operational sources are handled — off by default, pseudonymous, or full names for authorized administrators only.
Where the AI runs
Haryts answers with its own AI model, run on Haryts-operated hardware — no external AI provider receives your documents or questions. Haryts can also run entirely inside your own environment, keeping processing on your infrastructure. For data classes where generation isn't permitted, evidence-only answers return cited sources with no generation at all.
This website
haryts.com is a static site with no server, database, or user accounts. It enforces HTTPS, a strict Content-Security-Policy and security headers, offers an optional bot challenge on its forms, and publishes a responsible-disclosure contact.
What we don't claim
We don't advertise regulatory certifications we don't hold. If your organization requires a formal security review, penetration testing evidence, or specific compliance mappings, we'll work through your requirements as part of a scoped pilot rather than making claims here.
Responsible disclosure
If you believe you've found a security issue, please contact us through the contact page so we can look into it promptly.
Bring your security team into the conversation
We'll walk your reviewers through exactly how answers are grounded, cited, and recorded — and how your knowledge stays isolated.