Security & Privacy

Local-first architecture — your data stays on your machine. Cloud AI is opt-in. Designed for healthcare, government, and commercial data.

Local-First Design

The Workbench runs entirely on your own infrastructure. All data processing happens on your hardware. Database connections are direct. Uploaded files are stored locally. Nothing is sent to external services unless you explicitly configure it.

This is the defining architectural constraint. The Workbench was designed from the start for medical research data with strict privacy requirements. Cloud-dependent alternatives were ruled out. This is not an afterthought — it shapes every design decision.

AI Privacy

AI-guided features can use cloud AI providers (Anthropic, OpenAI-compatible) or a local LLM via Ollama. With Ollama, no data ever leaves your machine. Cloud AI is opt-in — the structured recipe builder works without any AI connection.

Deployment Security

Use a reverse proxy (NGINX) with HTTPS
Change the default admin password immediately
Set a strong password policy in Admin → Setup → Options
Disable demo mode in production
Configure email sender address — registration emails will fail with the default
Review and disable unused AI providers
Set appropriate upload file size limits
Schedule regular backups of the PostgreSQL metadata database

← Mobile & Responsive UI 📋 Contents Licensing & Feature Gates →