Security Policy
We take the security of Purple8 DocIntel seriously. This page explains how to report vulnerabilities and what to expect from our response process.
Supported Versions
| Version | Status |
|---|---|
| 0.12.x | ✅ Current release — actively supported |
| < 0.12 | ❌ Upgrade to 0.12.5+ |
Reporting a Vulnerability
Do NOT open a public GitHub issue
Public disclosure of a security vulnerability puts all users at risk. Please report vulnerabilities privately using the process below.
How to report
Email us at:
Include the following in your report:
| Field | Description |
|---|---|
| Description | What the vulnerability is |
| Reproduction steps | Minimal steps to trigger it |
| Impact | What an attacker could achieve |
| Affected versions | Which versions are affected (if known) |
| Suggested fix | Optional, but appreciated |
What to expect
| Stage | Timeline |
|---|---|
| Acknowledgement | Within 48 hours of your report |
| Assessment & status update | Within 5 business days |
| Patch for critical issues | Target: within 14 days |
| Coordinated disclosure | We will coordinate timing with you |
Recognition
We gratefully acknowledge security researchers who report vulnerabilities responsibly. With your permission, we will credit you in the release notes and CHANGELOG.
Security Architecture
Purple8 DocIntel is designed with security as a core principle:
License Integrity
- HMAC-SHA256 signed license keys — license keys are cryptographically signed to prevent tampering
- Offline validation — license verification works entirely offline, no phone-home required
- Tier enforcement — feature access is gated by cryptographically verified license tier
Data Handling
- No data persistence — documents are processed in memory and not stored after extraction
- Temp file cleanup — temporary files are automatically cleaned up after processing
- SSRF protection — URL-based extraction validates targets to prevent Server-Side Request Forgery
API Security
- Bearer token authentication — all API endpoints support configurable API key authentication
- CORS configuration — configurable allowed origins (default: restricted)
- Input validation — all inputs are validated through Pydantic models before processing
- File size limits — configurable maximum upload size (default: 100 MB)
- Concurrency limits — configurable maximum concurrent jobs to prevent resource exhaustion
Network Security
- TLS recommended — deploy behind a TLS-terminating proxy in production
- No outbound data — the service only calls the configured LLM API and Purple8 Graph (if enabled)
- Rate limiting — recommended to deploy behind a rate-limiting reverse proxy
Contact
| Topic | Contact |
|---|---|
| Security reports | security@purple8.ai |
| General enquiries | hello@purple8.ai |
| Enterprise | enterprise@purple8.ai |