Security and data protection
This page is the starting point for a security review. Each section says what GraphPilot does and links the page with the detail.
For personal data in particular, what is recorded, what your origin receives, how long it is kept and every setting that reduces it, see privacy and personal data.
Ways to control this
Section titled “Ways to control this”| Through | What it controls |
|---|---|
gpilot.toml | Who may call (authentication, client profiles), what a request may carry (request limits), which operations run (persisted queries), and what is recorded about a request ([telemetry]). |
| Your origin | What may be cached and for whom (authenticated requests), and whether a request really came from GraphPilot (verifying the signature). |
| The portal | Your password and multi-factor authentication, sessions, members and roles, API keys, and rotating a service’s signing key. |
Where your data lives
Section titled “Where your data lives”- Cached responses are held in the edge cache at the locations that served them, worldwide, with no region pinning. Data that must not leave a region should not be cacheable. See where data lives.
- Request telemetry is kept in the EU for at most 90 days. How far back Insights reaches depends on your plan, from 1 day on Glider (Free) to 90 days on Jumbo (Enterprise). See telemetry and logs and what Insights needs.
What is recorded about a request
Section titled “What is recorded about a request”authorizationandcookieare not stored as sent. By default they are replaced by a keyed digest, and only a handful of descriptive headers are kept. You choose which headers are recorded with[telemetry.headers].- The client’s IP address can be kept in full, truncated to its network part, or not stored at all, per service: see client IP address.
- Which requests are recorded at all can be narrowed with
telemetry.record.
Every category of recorded data and the setting that controls it is listed on privacy and personal data.
Protecting your origin
Section titled “Protecting your origin”- Request signing: every request GraphPilot forwards is signed with a per-service key, so your origin can refuse anything that did not come through it.
- Origin allowlist: the IP ranges GraphPilot reaches your origin from, for a firewall rule.
- Authentication: credentials are verified at the edge on every request, a cache hit included.
- Hardening: request size, query depth, document size, selection and introspection limits, and what the edge does not check.
- Persisted queries: run only the operations your clients registered.
Accounts and access
Section titled “Accounts and access”- Sign-in: password and multi-factor authentication, and a list of active sessions you can revoke.
- Access within an organization: four roles and API keys, both made of the same permissions.
- Deletion: delete your account or delete an organization, and what each removes.
- Not available yet: single sign-on (SSO/SAML) and an audit log; see current limitations.
Service status
Section titled “Service status”Incidents and maintenance on GraphPilot’s side are posted on the status page.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Report a suspected vulnerability privately to security@graphpilot.io, not in a public issue or forum. Include the steps to reproduce it, the service hostname or page it affects, and what you observed.