euvyra
DeutschRun it yourself

Security and sovereignty

Your data stays where you decide.

EUVYRA runs on infrastructure you choose and contacts nothing you have not allowed. It does not phone home, and it proves that with a report generated from its own running configuration.

Run it yourself

What stays under your control

Where it runs
Docker Compose or Helm on your servers or any European cloud, with PostgreSQL and S3-compatible storage that you operate and encrypt.
What leaves
Nothing, unless a host is on the outbound allowlist. Empty means no outbound connections at all, and the Helm chart enforces the same list as a network policy.
What is stored
Personal data is redacted in the SDK before it is sent and again on arrival. End-user ids are pseudonymized. Projects can keep metadata only.
How long
Retention per project for traces, runs and evaluations, and GDPR erasure of a person's traces that keeps only a hash of the identifier.
Who did what
An append-only audit log, chained by hash and protected by a database trigger, with every change made by people, API keys and AI assistants.
What you can prove
Evidence packages signed with Ed25519 that verify offline, without contacting EUVYRA or anyone else.

EUVYRA embeds no analytics, error tracking or email service, and its console bundles its own fonts. This site does the same.

Self-hosting

Docker Compose starts PostgreSQL 17, an S3-compatible object store with encryption at rest, the API, a background worker and the console. The API port binds to localhost; a TLS-terminating proxy of your choice exposes the console.

Kubernetes users install the Helm chart. Secrets come from an existing Kubernetes Secret, migrations run as a pre-install and pre-upgrade hook, pods run as non-root with read-only root filesystems, and a NetworkPolicy lets the API and worker reach DNS and the address ranges you list, nothing else.

Training jobs and model endpoints run where the agent runs. Job pods drop all capabilities, cannot escalate privileges, use the default seccomp profile and mount no service account token. Each job gets an API key limited to its project, which expires with the job.

Data residency report

The residency page is generated from the running configuration: where each component runs, the outbound allowlist and recent outbound attempts, including blocked ones. Evidence packages carry the installation's region too. Some things it cannot see, and you assess them yourself:

  • where your PostgreSQL and object storage provider actually keeps data and backups;
  • your ingress, CDN and TLS termination;
  • the sub-processors of any external model provider you allow;
  • support access by your hosting provider.

Personal data, redacted twice.

Before a span leaves your process, the SDK masks or hashes emails, IBANs, card numbers, phone numbers, German tax and health insurance numbers, IP addresses and common credential formats, plus any patterns you add. The server applies the project's own policy again on arrival, so a misconfigured client does not leak.

The gateway does the same for requests to endpoints set to redact, before they leave EUVYRA. End-user ids become pseudonyms derived with the installation's secret key.

Pattern matching does not find names or free-text health details. Projects that handle such data can store metadata only: timings, tokens and costs without inputs and outputs.

import euvyra

euvyra.configure(
    project="support-bot",
    redact=True,
    redaction_mode="mask",  # or "hash"
    custom_patterns=[
        {"name": "patient", "pattern": r"PAT-\d{6}"},
    ],
)

Access and accountability

  • Organization roles: owner, admin, member, auditor (reads everything and exports evidence, changes nothing) and viewer. Project roles: admin, editor, viewer; members see only their projects.
  • Governance functions such as engineering, privacy, compliance and risk decide who may sign which approval step.
  • Single sign-on with OIDC or SAML, and user provisioning over SCIM.
  • API keys are scoped to a project or the organization, carry ingest, read, write or invoke scopes, expire, and are stored only as SHA-256 hashes.
  • Browser sessions use an HttpOnly cookie, and state-changing requests need a header that cross-site forms cannot set.
  • Secrets for cloud accounts, LLM judges and webhooks are encrypted with a key derived from the installation's secret and never returned by the API.

AI assistants

Assistants connect over MCP with OAuth 2.1: authorization code with PKCE, tokens bound to the MCP resource, one-hour access tokens and rotating refresh tokens, where a reused token revokes the whole connection. An assistant acts with the permissions of the person who connected it, every change lands in the audit log under its name, and decisions that must be a person's stay in the console: approvals, incident classification, erasure, access changes and spending.

Questions from security reviews

Does EUVYRA send telemetry to its makers?

No. The product contains no analytics and no error tracking. With an empty allowlist the server opens no outbound connections, and the residency page lists every attempt.

Does the cluster that runs jobs need inbound access?

No. The agent connects out and pulls work. The only inbound path EUVYRA needs is to model endpoints that its gateway calls.

How do we verify an evidence package without trusting the vendor?

Run euvyra evidence verify package.zip --public-key installation.pem. It checks every file hash and the Ed25519 signature offline. Keep a copy of the installation's public key with your auditors.

Can the audit log be edited by an admin?

Every entry stores the hash of the previous one, so any edit or deletion breaks verification from that entry on. On PostgreSQL a trigger rejects updates and deletes on the table outright.