Security checklist
| Control | Free | Enterprise |
|---|---|---|
| Single sign-on: OIDC (Entra ID, Google, Okta, Keycloak) and SAML 2.0 | ||
| SCIM 2.0 provisioning | ||
| Departments, teams and roles | ||
| SSO required, with audited break-glass | ||
| Attachment quarantine and malware scanning | ||
| Signed evidence and hash-chained audit log | ||
| Autopilot watchdog and emergency stop | ||
| Content-Security-Policy and security headers | ||
| Data governance suite | — | |
| Deployment without internet access, with local models | — |
Every security control is included in every plan. Enterprise adds operations at scale.
Your network is the boundary
Kurahi is a service you install and run. Connectors and model providers are off until an administrator turns them on.
Identity under your control
Single sign-on
OIDC with Entra ID, Google, Okta or Keycloak, or SAML 2.0, for everyone who uses the console.
SCIM 2.0
Users and groups are provisioned and removed from your directory.
Roles and departments
Directory groups map to roles, departments and teams, which approval routes and access rules use.
SSO required
Once it is on, token logins of people become an audited break-glass.
Attachments are guilty until scanned
Quarantine first
Every attachment is held in quarantine before anything is stored.
Static file policy
Executables, scripts, macro-enabled Office files and encrypted archives are refused, decided from the bytes, not the file name.
Malware scanning
ClamAV or Microsoft Defender. If the scanner cannot answer, the file is refused.
Isolated text extraction
Text is extracted in isolation, and a refused attachment flags its message for a person.
Agents bounded by policy
No dangerous tools in the autopilot model
The model that plans a routine holds no tools at all, so it cannot send, pay or delete. The engine checks every proposal against the routine's level.
Untrusted content is marked as data
Mail, documents and web pages reach the autopilot model inside marked data blocks. This reduces prompt-injection risk, and that model has no tool to act on an injected instruction.
Enterprise package
A separate package with the consumer-channel plugins omitted; they are refused at runtime even if someone copies them in, and you can verify the package yourself.
Policy as code
Tools, providers, paths and channels are governed by versioned policy files, with a kill switch.
Evidence your auditors can verify
Every autopilot run writes a signed evidence bundle; approvals, flag clearances and configuration changes are in a hash-chained audit log. Evidence holds identifiers and counts, never mail bodies, and verifies offline without the gateway.