What you own
Mithra runs on a server you operate. You own Linux updates, DNS, TLS, the firewall, the reverse proxy, monitoring and where backups are stored. Mithra never installs packages, changes your firewall or manages DNS.
Who can get in
- There is no signup. Only email addresses on the operator’s allowlist can set a password.
- A household holds at most two adults. The second joins through a one-use invitation bound to their email address.
- Passwords are hashed with Argon2id. Reset, invitation and session tokens are random, and only their SHA-256 hashes are stored.
- Removing a person revokes their sessions, reset links and invitations at once.
Who sees what
- Only you is the default. A record is visible to the other adult only when it is marked Shared.
- Shared views never reveal a private record, or even that one exists.
- Every change checks the household and the record’s version, so a stale or cross-household edit fails without exposing anything.
Encryption at rest
- A 32-byte master key, delivered as a private credential file, protects the data. Separate keys for settings, uploaded sources and backups are derived from it.
- Uploaded files are sealed with AES-GCM before they are saved.
- In the container image, the whole SQLite database, its write-ahead log and every backup snapshot are encrypted with SQLCipher (AES-256). Container mode refuses to start on an unencrypted database.
- The systemd install keeps plain SQLite on owner-only paths.
Losing or changing the master key makes the data unrecoverable. Keep a copy away from the server and away from your backups.
Reading files safely
In the container setup, PDFs are read by a separate parser process with no network, no data volume, no secrets and tight memory and process limits. It restarts every five minutes as a clean process.
Signed releases
Releases ship a signed manifest. The install guide checks the public-key
fingerprint, the manifest signature and each file’s digest before anything
runs as root. There is no curl | sudo sh.
AI providers
AI is optional. Without a provider, every record you enter still works. When the household owner adds one, the key is encrypted and never shown again, requests go only to fixed HTTPS origins, and custom endpoints cannot point at private or loopback addresses.
What Mithra will not do
It never changes a record without your confirmation, never spends money or makes bookings, and never gives medical or financial advice.
Reporting a problem
Report a security issue privately through GitHub security advisories. The full technical contract is in security.md.