Zero bytes leave your machine.^* By design, by audit, by license.

Pillars

Threat model

Nora is designed against three attacker shapes. We name them so you can verify your posture against them.

T1. Network exfiltration of session content

Mitigation: Zero-network invariant (AST-audited via kernora network-check). The hot path — capture, analyze, promote, emit — has no permitted network call outside the explicit NETWORK_ALLOWLIST. Every emit is local I/O to ~/.kernora/ or <your-project>/.nora/. The only egress points are: (a) the LLM call from analyzer.py, which you BYOK and route to your chosen provider; (b) git push, which you trigger explicitly. Cost + token usage of (a) is logged in the kernora_usage table; (b) is in your normal git history.

On-prem hardening: kernora install --on-prem locks LLM provider to Ollama (local) and sets telemetry.enabled = false, eliminating egress (a) entirely.

T2. Secrets leaking into the factbook

Mitigation: Pre-commit PII guardrail. The 15 rules cover AWS / OpenAI / Anthropic / Google / Stripe / Slack key formats, GitHub PATs, OpenSSH PEM private keys, bearer tokens, JWTs, URL-embedded credentials, SSNs, credit cards, and email addresses. The hook runs before markdown lands in .nora/. False positives can be allowlisted with the kernora-pii-allowlist marker.

Run on demand: kernora pii-scan <path>. Exit 1 on critical/high.

T3. Tampering or impersonation of the factbook

Mitigation: Git is the audit trail. Every fact is a markdown file under version control with author + timestamp + diff. Reviewers can see what changed, who promoted it, and through which agent. There is a single canonical promotion gate — no side paths that could allow unsigned or unreviewed facts to enter the factbook.

T4. Cross-team data leak in multi-tenant Free installs

Mitigation: Every dashboard query against team-scoped tables enforces a team boundary at the data layer, appending AND team_id = ? to the WHERE clause when a team is configured (via --team-scope at daemon start or KERNORA_TEAM_ID env var). Cross-team exports are structurally prevented — the team boundary is applied at query construction, not filtered after the fact. The enforcement is covered by an automated test suite that includes spoofed-query-param attacks returning zero rows. Personal-mode installs (default) skip the team filter entirely — there is no team boundary to enforce.

Architecture posture

Compliance & deployment

--on-prem mode

For finance, health, and defense:

• Locks LLM provider to Ollama only (local inference, no API keys, no egress)
• Forces [telemetry] enabled = false
• Re-runs kernora_network_audit at install, blocks if any new module on the hot path can reach the network
• Same source code, same build artifacts as the OSS install — no proprietary binary; you can reproduce the audit locally

SSO / SAML / SCIM

Available on the Enterprise plan for the team dashboard repo (which lives in your GitHub org). Solo Mode 1 has no auth surface to federate — it runs in your terminal under your local user.

Audit log format

Append-only JSONL, date-rotated daily at ~/.kernora/logs/agent_safety/{YYYY-MM-DD}.jsonl. Each entry includes the ISO-8601 timestamp, the agent that emitted the event, the event type (pii_block, prompt_injection_block, path_denied, etc.), and a short detail field. Visible at http://localhost:2742/audit-log (last 50 events of the current day). The format is plain JSONL — replayable, greppable, exportable for compliance review. Never overwritten by Nora itself.

Retention & right-to-be-forgotten

~/.kernora/config.toml:

• retention.clean_signals_days = 90 — short-lived P1 outputs auto-purged
• retention.reasoning_traces_days = 90 — captured CoT auto-purged
• retention.sessions_days = 365 — session history
• Verified facts in .nora/ are not auto-purged. They are tracked files; you delete them with git rm like any other file.

On-demand purge: kernora purge --project <name> (one project) or kernora purge --all (everything). Add --no-archive to skip the pre-purge archive, --yes to skip the interactive confirm, --dry-run to preview. Every purge writes a line to the agent_safety log.

Source-available, auditable

Nora is licensed under Elastic License 2.0. You can read every line of code, fork it, embed the SDK in your own products, and audit the hot path yourself. The constraint: you can't resell Nora as a hosted service competing with Kernora. Internal commercial use is unrestricted.

Source: github.com/kernora-ai/nora. The README in that repo carries the architecture overview, install command, and the network-egress matrix above. Enterprise deployments (SAML / SCIM / audit log retention) are gated by contract — email hello@kernora.ai for the readiness checklist.

Reporting a vulnerability

If you find a security issue, please report it privately before public disclosure. We aim to acknowledge within 48 hours and ship a fix or mitigation within 14 days for critical issues.