Skip to main content

Security

This part of the documentation is written for security, IT and compliance teams that are evaluating Q247 before deployment or answering audit questions. Here you will find specific algorithms, connection directions and closed lists of the data passed.

The rest of the documentation shows how to configure something; here it is described what happens to the data with that configuration.

Areas of the specification​

Q247 consists of two components, and login is a separate matter from both. That is why the specification is split into three pages.

Enterprise Plugin Security covers the component running closest to the Client's data, because it clones and analyzes repositories. It answers the questions: what permissions the process needs, what firewall rules apply, what stays local, and what is sent to Q247 and in what form.

Management Portal Security covers the web application itself: what it runs on, how manager access is secured, and what service access looks like on the vendor's side.

SSO Security covers login through an external identity provider: the course of the Authorization Code Flow, the signing and encryption algorithms, client secret protection, and the direction of traffic between Q247 and the provider.

Frequently asked questions​

QuestionWhere the answer is
Does source code leave our network?Enterprise Plugin Security
What inbound traffic do we need to allow?Firewall rules and the direction table in SSO
What exactly reaches your database?closed field lists in Data exchange
How do you protect our OIDC secret?Client secret encryption
What happens when our firewall does TLS inspection?TLS inspection at the firewall

The scope of data passed to the language model for AI features is described separately, on the Language model page, because it depends on the deployment variant chosen by the Client.

Subpages​

See also​