Security & Enterprise
GreyCat ships enterprise security in the same binary as the database — no bolt-on IAM, no external services.
Authentication
Token-based auth
User identities authenticate with tokens, passed either via
cookie or an Authorization header, and each token carries a time-to-live (TTL).
Self-generated server key
On first run, the server generates its own key — no manual secret provisioning required to get started securely.
Authorization (RBAC)
Declared in code
Role-based access control is declared in code with
@permission and @role. Every @expose endpoint is
permission-gated.
Built-in permissions & roles
Ships with built-in permissions — public,
api, admin and debug — and built-in roles, plus per-user
file read/write grants.
- Role-based access control declared with
@permissionand@role - Every
@exposeendpoint is permission-gated - Built-in permissions:
public,api,admin,debug - Per-user file read/write grants
Single sign-on
OpenID Connect (OIDC)
Enterprise OpenID Connect via the openid library,
using the Authorization Code flow with PKCE.
JWT & group mapping
JWTs are verified against the provider's JWKS (RS/ES/PS), and identity-provider group claims are mapped to GreyCat roles.
Cryptography
Primitives
SHA-1 / SHA-256, HMAC-SHA256, RSA PKCS#1 signing, base64 / base64url / hex encoding, and secure UUID v4 / v7 generation.
Backed by mbedTLS & TLS
Cryptography is backed by mbedTLS 3.6, and TLS protects data in transport.
Auditability
Audit trails
Built-in task history and file-upload hooks provide the foundation for audit trails.
Data sovereignty
Fully self-hosted
A single binary running on your own hardware.
On-device AI
Embeddings and inference run in-process via llama.cpp, so data never leaves your infrastructure.
Built in the EU
Built in Luxembourg (EU).
Minimal attack surface & operations
Tiny container
Deployable as a FROM scratch container (~3.5 MB)
with no OS package manager to patch.
Verified backups
Full and incremental (delta) backups with verified restore.
Online defrag
Defragmentation runs online, without taking the database offline.