Security and isolation

Your data boundary is the product boundary.

Teleza is designed around tenant-scoped API access, bounded report execution, safer provider defaults, and private deployment options for teams with data-sovereignty requirements.

Implemented Controls

  • Customer-scoped API keys use the X-API-Key header.
  • Report list, read, update, delete, preview, execute, schedule, and usage paths enforce ownership.
  • Admin operations require JWT role authorization.
  • Query and report row counts are capped.
  • The runtime data-source catalog is limited to InMemory, REST API, PostgreSQL, SQL Server, CSV, and Excel for private beta.
  • REST provider calls reject unsafe endpoint shapes by default and stream bounded reads.
  • Customer data-source secrets are stored write-only and are not returned through read APIs.
  • Template mappings let customer field names be normalized without exposing source credentials.
  • Payload render lets buyers keep database access inside their own application boundary.
  • Payload render supports field-level masking rules so sensitive values can be redacted before preview and export.
  • Payload preview returns lineage.contractHash and hashed option evidence without embedding raw customer rows.
  • Payload-render telemetry persists lineageContractHash for later support and customer evidence review.
  • Placeholder JWT secrets are rejected at startup.
  • Dependencies and build output are reviewed before release.

Operational visibility

The private-beta operator dashboard is designed for release safety: API health, provider readiness, recent errors, slow executions, top-customer usage, scheduled jobs, beta requests, customer onboarding, and usage/billing review are separated from customer-facing API access.

Data sovereignty

Teleza can be deployed as a Dockerized API with a static dashboard. For private-cloud or self-hosted enterprise pilots, the buyer can keep report data, database credentials, and generated documents inside their own environment.

Private deployment helps keep data inside your environment, but formal compliance certification is scoped separately.

Docker boundary

The VPS beta path runs Teleza as a Caddy-fronted Docker service: the API container listens on internal port 8080, binds to 127.0.0.1:8587 on the host, runs as a non-root service user, and keeps generated exports out of the persistent container layer.

The persistent SQLite beta path uses the mounted /data volume. Temporary render scratch space is volatile and bounded, so container replacement does not imply report-output storage.

Scope Boundaries

  • Formal SOC 2, HIPAA, PCI, ISO 27001, or banking compliance commitments require a separate agreement.
  • High-availability targets, support windows, and recovery objectives are defined per deployment.
  • Generated templates and uploaded report definitions are treated as untrusted input and validated before use.
  • Enterprise scheduling, dedicated infrastructure, and private networking are scoped with the customer environment.

Private-cloud review checklist

  • Environment configuration reviewed before launch.
  • CORS origins and JWT settings confirmed.
  • Database provider and persistence path confirmed.
  • OpenAPI and metrics exposure decisions confirmed.
  • Backup, restore, rollback, logs, and alert paths confirmed.