Source integrity
Immutable source artifacts, checksums, deterministic document identities, and explicit version activation.
Security and provenance
Trust starts before the retrieval request.
CorpusMesh is being designed around source integrity, tenant isolation, bounded access, and operational recovery. This page describes the current engineering principles, not certifications we have not earned.
Tenant boundaries
Scoped entitlements, default-deny filters, bounded responses, and auditable API-key lifecycle design.
Operational recovery
Health checks, release traceability, rollback paths, and restore verification for canonical data.
Secret handling
Runtime credentials stay outside source control and are injected through the managed secret system.
Provenance by design
The source record is part of the product.
Knowledge-base versions are intended to preserve source authorities, canonical locations, licensing evidence, document checksums, transformations, and verification state.
Retrieval projections remain replaceable. Canonical records and immutable artifacts do not depend on a particular vector database.
Inspect the EU AI Act trace to see the current lineage and boundary evidence. Published availability, service commitments, and security claims will be added only when they are operationally supported.
Responsible disclosure
Found a security issue?
Send a clear report to [email protected]. Please do not access data that is not yours or disrupt the service while investigating.