Security and data ownership

Security and data ownership

TicketMan AI is built so that adopting AI never means surrendering your data. The defaults keep everything inside your walls.

Your data, your tenant

The platform is self-hosted and backed by your own PostgreSQL. Every document, conversation and record stays on infrastructure you control. There is no vendor cloud in the path unless you deliberately choose a hosted model.

Your AI boundary

You control where AI processing happens. Each LLM function can be bound to its own connection and model:

• Hosted cloud models (OpenAI, Azure OpenAI, Anthropic, Grok): ticket content and crash context are sent to the provider's API.
• Local models (Ollama): all processing stays entirely on your hardware. No ticket content, crash context, or other data leaves your network.

You can mix providers per function: route high-sensitivity work to a local model and cost-optimized work to a smaller cloud model. The boundary is yours to set. See AI and models.

Your keys, encrypted

All third-party secrets, both channel and LLM keys, are encrypted at rest and are write-only over the API: the client only ever sees a "key is set" flag, never the value. The platform fails fast if its encryption key is missing.

Identity you already trust

Authentication is Entra ID (Azure AD) end to end, with role and admin authorization policies. There is no separate identity store to manage.

What the Diagnostics SDK protects

The crash-reporting SDK is conservative by default and cannot be made more permissive without explicit configuration:

• Masking is always on. Secret-shaped values (connection strings, API keys), known secret-key field names (password, token, apikey, secret), and JWT-shaped tokens are automatically redacted before anything is written to disk or sent over the network.
• Headers are selectively captured. Authorization and Cookie headers are never captured, not even in masked form.
• Bulk data is never collected. Response bodies and full heap dumps are excluded.
• User identity and request bodies are opt-in only. By default, neither the authenticated user identity nor incoming request bodies are captured; both can be enabled via environment variables if your application's data classification permits.

For the full field-by-field inventory and masking rules, see What data is collected.

Human-in-the-loop automation

Every AI action in the platform is surfaced for approval. Drafts and suggestions are never sent automatically. On the Dev Server plan, every automated step in the self-healing loop has a gate you control, and pull requests can require human review before they merge.