Security is architecture, not a feature.

Inkury's security model is built into the editor core. Documents are encrypted, plugins are sandboxed, and audit trails are automatic. Here is how it works.

Data residency

Your documents live on your devices first. Sync is encrypted in transit and at rest. Enterprise customers can choose where their data is stored and whether it leaves their network at all.

✓Local-first architecture: data exists on your device before any server
✓AES-256 encryption at rest, TLS 1.3 in transit
✓Enterprise self-hosted option for full data sovereignty
✓Region-specific hosting available (AU, US, EU)
✓No third-party analytics or tracking on document content
✓You can export and delete all your data at any time

Plugin sandboxing

Plugins run in isolated sandboxes with explicit permission grants. A plugin that formats text cannot access the network. A plugin that fetches data cannot modify your document without your approval.

✓Each plugin runs in its own isolated context
✓Capability-based permission model (network, storage, DOM)
✓Plugins cannot access other plugins’ data
✓All plugin actions are logged and auditable
✓Enterprise admins can allowlist and blocklist plugins
✓Plugin code is reviewed before inclusion in the marketplace

Compliance

Inkury is built for organisations that operate under regulatory requirements. Audit logs, access controls, and data handling policies are built into the product, not bolted on after the fact.

✓SOC 2 Type II compliance (in progress)
✓GDPR-ready with data processing agreements available
✓Full audit log of document access and modifications
✓Role-based access control with SSO integration
✓Data retention policies configurable per workspace
✓Regular third-party penetration testing

Responsible disclosure

Found a security issue? We take every report seriously. Please email security@inkury.com with details. We will acknowledge your report within 24 hours and aim to resolve confirmed issues within 72 hours.

Need more details?

We are happy to discuss our security architecture, provide compliance documentation, or arrange a call with our engineering team.