SpiderFolioOn your server
The database, files and backups stay on your infrastructure, in the country and with the provider you choose. Nothing goes through our servers.
Security
Your internal documentation, protected
SpiderFolio runs on your server. This is what the software does to protect your company's information, and what is up to you.
Isolation between companies
Every database query is limited to the company of the person making it, and an automated test checks that one company never sees another's data.
Permissions that explain themselves
Access is given to departments and roles. On every folder, file and page you can see who has access and why. Permissions are always checked on the server.
Protected accounts
Passwords hashed with Argon2, two-step verification with recovery codes, revocable sessions, sign-in alerts and attempt limits.
Audit log
A tamper-proof log of what happens in the company: access, permission changes, approvals and reads, exportable for an audit.
Open source
You can read and audit all of the code. Each installation's secrets (2FA, your own SMTP) are encrypted with keys only your server has.
What is up to you
- HTTPS (the https profile sets it up automatically with a domain)
- Keeping up to date with the latest version
- Daily off-server backups, and testing that restoring works
- A firewall with only ports 80 and 443 open (and key-based SSH)
- Keeping the .env file somewhere safe
If you turn on Bian, the document excerpts for each request are sent to the Anthropic API with your own key. If you use Sentry, error events carry no personal data.
Report a vulnerability
Don't open a public issue: follow the repository's security policy.