Security

Last updated: November 5, 2026

The short version

pAIring and Matricxon run on your own servers. Your prompts, chats, documents and models stay there, and we never receive them. The code is open source, so you can check every claim on this page.

Your data stays with you

• No cloud in the middle. There is no BytePenny server between your users and your models, and the software does not send us usage data.
• Nothing is used for training. Prompts and replies are saved only in your own database.
• Private by default. Each user's chats are private, admins included. Channel messages are seen only by channel members.

How the software protects it

• Passwords are stored as bcrypt hashes. Repeated failed logins are blocked for 15 minutes.
• Stored secrets, such as API keys and proxy passwords, are encrypted in the database and never shown again after saving.
• Saved chat caches on Matricxon are encrypted with AES-256-GCM.
• Cluster calls that change models or settings are signed, and a captured call cannot be replayed.
• Roles are checked on the server for every admin action, not only in the browser.

The full details and a go-live checklist are in the pAIring security docs.

When we help you

Support usually needs only logs, versions and settings. If we need access to a server, it is given only with your approval, for a limited time, and we ask for technical data only, never your documents or chats.

Open source

Both products are published under the GNU AGPL-3.0 license on GitHub. Your team, or anyone you trust, can review the code before installing it. Every change is checked by GitHub's CodeQL code scanning, and Dependabot watches the libraries we depend on.

pAIring has earned the OpenSSF Best Practices 'passing' badge, an open checklist for how a project is built, tested and kept secure. Matricxon's is in progress.

AI-specific risks

See how pAIring handles each risk in the OWASP Top 10 for LLM Applications, from prompt injection to runaway usage.

This website

The site is served only over HTTPS, with strict browser security headers. It uses no cookies, analytics or tracking. See the Privacy Policy.

Reporting a vulnerability

Please report security issues privately to support@bytepenny.com with "Security" in the subject, or through GitHub's private vulnerability reporting. We confirm receipt within 3 business days, coordinate the disclosure date with you, and credit you if you wish. Details: our security policy and security.txt.