Skip to main content

Verify, don’t trust

Self-hosted or air-gapped, citation-backed answers, public Community source, and no telemetry by product design.

Security buyers and operators should be able to check claims, not take them on faith. RAGSuite is built so data stays in your perimeter, answers cite sources, and the Community Edition code you run is public under Apache 2.0. What this section covers
  • Sovereignty principles — self-host, air-gap, no phoning home.
  • How to report issues and what the security policy expects.
  • License and NOTICE scope for Community vs Enterprise.
Use these pages in due diligence alongside your own network and deployment review.

Review sovereignty principles, security reporting, and license scope.

SovereigntySecurity policy

​
In this section

Sovereignty

Self-hosted control, citations, and no telemetry by design.

Security policy

How to report vulnerabilities and what we expect.

License & NOTICE

Apache 2.0 Community scope and Enterprise NOTICE.

​
Interactive tour