Zero-Compromise Security Architecture

We built AlafNode with security in mind so you can be confident your data is safe while controlling your local models.

Agent Identity (Ed25519)

Each node generates a unique Ed25519 keypair. The private key is only stored on the device.

Signed Heartbeat

Every heartbeat signal is signed with the private key and verified server-side (Replay Protection).

Data Isolation

Thanks to Firestore Security Rules, no user can access a device or model that does not belong to their organization.

No Remote Commands

By design, no OS commands can be sent via the agent. (No Remote Shell rule).

No Prompt Logging

Messages you send via the app or outputs generated by the model are never written to centralized logs.

Security is Our Priority

Ed25519 authentication
Signed heartbeat signals
Local private key storage
End-to-end secure node pairing
Full control over data and code
No remote shell execution
Prompt and response data are not logged

// Agent Pairing Protocol
func (a *Agent) Connect() {
  pub, priv := ed25519.GenerateKey(nil)
  token := a.PromptUserForToken()
  
  // Secure Hash Exchange
  hash := sha256.Sum256([]byte(token))
  err := a.Backend.Verify(hash, pub)
  
  if err == nil {
    // SUCCESS: Heartbeat uses signature
    a.StartSignedHeartbeat(priv)
  }
}
// NO REMOTE SHELL IMPLEMENTED
// ONLY SAFE HARDWARE METRICS