Security
The data stays in — by architecture, not by promise.
Every customer runs in their own isolated stack — its own database, cache and file storage — hosted by us, or on infrastructure you control under Enterprise.
One database per customer
Every note, board, message and file lives in a database that belongs to your workspace alone. There is no shared table and no tenant column that could leak one customer's rows into another's.
Signed license, verified locally
Your entitlement is an Ed25519-signed envelope verified inside your own instance. An Enterprise install runs fully air-gapped too — the license check-in is optional and switchable off.
Roles & permissions
Global tiers plus per-space, per-board, helpdesk and HR roles. Sensitive actions require a fresh re-authentication step.
Two-factor and step-up auth
TOTP two-factor with backup codes, plus a fresh re-authentication prompt before role changes, hard deletes and privilege grants.
Scoped API keys
Machine access runs on ilveno_ keys with their own scopes, listed and revocable per user — never a shared password in a script.
Sessions & audit trail
Users see and end their active sessions; admins get a full, exportable activity log and sign-in history. Accounts are protected with TOTP two-factor authentication and backup recovery codes.
What Ilveno never does
- Send your notes, boards, messages or files outside your own workspace
- Send usage analytics, session recordings or crash reports to us
- Share or sell your data to any third party
- Lock your data in — you can export and own your database at all times
The one call home: license check-in
We would rather document this than hide it. Roughly every 12 hours your installation posts a small license beacon to admin.ilveno.com, and gets back a signed entitlement so plan, seat and expiry changes reach you without a new key file. This is the same model Metabase and GitLab use for self-hosted licenses.
In your .env
# nothing set — the baked-in endpoint applies
Every 12 hours the installation posts the beacon below and receives a signed entitlement, so plan, seat and expiry changes reach you without a new key file.
- Your license id — the identifier printed on your own key
- An install fingerprint — a one-way SHA-256 of your deployment URL, so two installs sharing a key can be told apart
- Seat count in use, and the Ilveno version you are running
- A one-time nonce, so a captured response cannot be replayed at you
Compliance & disclosure
Your content stays in a database dedicated to your workspace and is never mixed with another customer's. Under Enterprise the same stack runs on infrastructure you control, which puts every GDPR and KVKK hosting decision in your hands. Found a security issue? Report it responsibly to [email protected].