Updated at: 25 September 2026
This overview describes measures visible in the code and deployment configuration. It is not a certification, penetration-test report, SLA, or claim of complete security. Operational practices not visible in the repository are marked for confirmation in the owner audit.
1. Access control and authentication
- Dashboard access uses Discord OAuth-based login, server-side sessions, and CSRF protection.
- Aside from the guild owner, and non-owner Administrator that adds Archivian, staff users must be explicitly added or invited.
- Guild and staff access is checked through role- and permission-based authorization.
- Private files are delivered through authenticated backend permission checks rather than exposed from the application filesystem.
- Administrative and internal endpoints are separated from public routes in the backend architecture.
2. Secrets and credentials
- Runtime credentials are supplied through environment or Kubernetes secret mechanisms rather than embedded in legal content.
- User and bot tokens are handled by a dedicated secrets service and separate data models.
- Production source-map upload credentials are build secrets; generated source maps are removed from runtime images.
3. Network and service separation
- Public traffic passes through Cloudflare as a reverse proxy in front of the Kubernetes ingress. Cloudflare provides authoritative DNS and terminates public connections at its edge, where its network- and application-layer protections are applied before requests reach application services. These include routing and access rules, automated mitigation of attack and abuse traffic, and the platform's standard filtering of malicious and anomalous requests. The protections in effect at any time are those provided by Cloudflare's platform and the configuration selected for Archivian's account, rather than a fixed list maintained here.
- Backend, bot, real-time, dashboard, website, data stores, and supporting services are separate deployable components.
- Archivian's production application workloads run in the dedicated Kubernetes namespace, providing logical separation from unrelated workloads on the cluster. Supporting workloads use separate namespaces where configured.
- Public ingress is configured for TLS and constrained cross-origin headers.
- Internal databases and caches are addressed as services rather than exposed through public website routes.
- Application-initiated requests to untrusted destinations use a shared HTTP client that routes them through a forward proxy hosted by Hetzner Online GmbH on a separate VPS outside the application's Kubernetes host. The client applies SSRF protections, including public-address validation and checks on redirect targets, before making those requests.
4. Data storage and transmission
- MongoDB and PostgreSQL are used for persistent records, relational records, and short-lived/cache states. MongoDB uses AES-256 encryption. DigitalOcean Managed PostgreSQL uses LUKS disk encryption.
- S3-compatible object storage is used for attachments and files; OVHCloud Object Storage uses AES-256 server-side encryption with OVHcloud-managed keys.
- Public web/API traffic uses TLS. Connections are terminated at the Cloudflare edge and re-established over TLS to the origin ingress, which uses certificates issued by Let's Encrypt through cert-manager. Provider-to-provider and internal transport settings require operational verification.
- Message, file, verification, backup, and anti-abuse records use feature-specific retention deadlines, TTL indexes, or cleanup jobs. Moderation records have no automated expiry by design: they are retained until the server operator, as controller, deletes them.
- When Archivian is removed from a server, that server's records and object-storage prefixes are erased after seven consecutive days of absence, unless the server re-adds Archivian or asks for deletion to be paused. Shared Data that Archivian controls are excluded from that sweep.
5. Logging, monitoring, and incident visibility
- Sentry collects application errors and sampled performance traces.
- PostHog receives server-side feature and operational events through its EU endpoint.
- Application audit records capture security-sensitive and staff actions in several modules.
- Cloudflare records request metadata and security signals for traffic reaching the public endpoints, retained under its own configuration and retention settings.
- Dashboard Session Replay is disabled; browser analytics are opted out by default pending a consent interface.
6. Availability and recovery
- Cloudflare's edge network absorbs and filters attack and abuse traffic ahead of the origin, reducing the load reaching application services during attacks and traffic spikes.
- Container health checks, multiple services, and Kubernetes deployment configuration support service recovery.
- Archivian has product features for Discord server snapshots and rollback; these are not the same as production infrastructure backups.
- MongoDB runs on an Atlas cluster with Point-in-Time backups enabled. Access is restricted by an IP allowlist and a dedicated Archivian service account; JavaScript queries are disabled. The account has the collection, index, and CRUD permissions required by the application.
- DigitalOcean Managed PostgreSQL uses the provider's managed backup defaults; with daily backups and point-in-time recovery (PITR), E2E SSL and standby nodes. Connections use pooling and an IP allowlist. Dedicated Archivian service accounts start without access and receive only the table- and action-level permissions required.
- OVHcloud Object Storage has no versioning, object lock, replication, or separately configured backup. Objects are private and accessible only through Archivian's authenticated and authorized API.
- Objects are generally retained until a feature-specific deletion rule applies. Selected path prefixes use lifecycle TTL rules, database retention records can trigger application-managed deletion when a TTL expires, and a departed server's current object prefixes are removed with its server-specific data after the seven-day termination period.
- MongoDB Atlas, DigitalOcean Managed PostgreSQL, and OVHcloud Object Storage are hosted in Frankfurt, Germany.
- Formal restore testing, recovery objectives, and disaster-recovery procedures remain to be documented.
7. Secure development and deployment
- GitHub Actions builds separate application container images, uploads them to private Docker Hub repositories, and triggers their deployment to Kubernetes.
- CI and Kubernetes access the private container repositories using authenticated registry credentials.
- Docker Scout image analysis is enabled for the backend, dashboard, and real-time container repositories to identify known vulnerabilities in image components. Findings inform dependency and base-image maintenance but do not guarantee that images are vulnerability-free.
- Package manifests track dependencies; source maps are uploaded to Sentry only when credentials are available and are removed from shipped images.
- Developer tooling surfaces known vulnerabilities in declared dependencies for review during development.
- Automated tests cover a number of permission, retention, and domain behaviors, although no independent security audit is claimed.
8. Deletion and data minimization
- Several collections use TTL indexes or scheduled cleanup, and private files have explicit delete operations.
- Preservation locks deliberately prevent message evidence from being purged while another moderation workflow needs it.
- Authenticated, controller-scoped access and erasure workflows provide request tracking, audit trails, record-level decisions, and explicit deletion or redaction handlers where supported.
- A scheduled sweep erases a departed server's data seven days after Archivian leaves it, gated on a live Discord membership check and on the running bot application's own identifier so that no sweep can reach another deployment's records. An operator-managed switch can pause it per server.
- Moderation records are deliberately retained until the server operator deletes them rather than expiring on a schedule. Erasure-handler coverage across subsystems, and separate infrastructure or vendor deletion procedures, are still being extended.
9. Personnel and incident response
Archivian is currently operated as a small founder-led service. Access should be limited to people who need it, reviewed when access changes, and protected with strong authentication. The internal breach procedure covers detection, containment, evidence, role analysis, notification assessment, remediation, and documentation. Its escalation contacts are not yet filled in, and formal access-review evidence and provider-access inventories require owner confirmation.
Domain registration is held with Namecheap, while authoritative DNS is served by Cloudflare rather than the registrar. Registrar and DNS accounts are administrative controls over service availability and certificate issuance, and are treated as privileged access alongside infrastructure accounts.
10. Known gaps before paid launch
- verify the published subprocessor list against signed provider contracts, resolve the transfer mechanism still marked pending there, and finish the customer-facing data processing agreement before it is offered;
- test restoration and record recovery objectives, separately from the product's server-snapshot feature;
- maintain and expand record-level erasure handlers, and verify collector and handler coverage whenever a subsystem begins storing new personal data;
- disable personally identifying error payloads in the real-time service, review Sentry PII behavior, and add payload scrubbing tests;
- implement consent/settings before enabling non-essential browser analytics; and
- populate the placeholder contacts in the internal breach procedure and rehearse the notification path.