Safe use of DI Cloud

Which account may open a project and the files attached to it comes down, in DI Cloud, to a single database function: it checks whether the signed-in account belongs to the organization that owns the project. The file store leans on the same function, because the RLS policy placed on stored objects reads the project identifier from the second segment of the path and verifies that identical permission. A path is assembled from the organization identifier, the project identifier, a folder marking where the file came from, and a name sanitized before it is written. The query that searches document fragments calls the same function, so isolation of data covers search as well, not only retrieval of a file. A separate migration withdrew anonymous privileges on private tables and left unauthenticated reads on the four tables where such reads are intended.

An attachment is examined before anything reaches the store. PDF, DOCX, TXT, Markdown, CSV and JSON are accepted, along with PNG, JPG, WEBP, GIF, HEIC and HEIF images, and the size ceiling depends on where the file enters the service: a conversation attachment stops at 25 MB, HEIC and HEIF at 20 MB because of a decoder constraint, a file imported into user documents at 10 MB with its stored content trimmed to 50,000 characters, and an image supplied as input for generation at 5 MB. Uploads within an hourly window are capped, sixty by default and adjustable in deployment configuration, and the counter keeps the limit key only as a SHA-256 digest, in a table open to the service role alone. Text is lifted out of a text file, and that text, together with its fragments and vectors, lands in the database, so the content of a document exists beyond the file itself. Where the attachment fails to commit, the object is removed from the store and the document row deleted.

The event log keeps a file name, its size and a fragment count; it does not keep contents. The administrative view returns an email address, account dates, the plan, subscription status and a count of runs over the last thirty days; it reaches neither conversations nor files, and entry to it is confined to a list of administrator identifiers. A key held under BYOK is encrypted with AES-256-GCM, and beyond the encrypted form only a masked version and a key fingerprint are retained; five model providers are supported in that mode. Where the user supplies an address to fetch, every redirect hop is checked separately, and loopback, private-network and link-local addresses are refused.

Security here has edges worth knowing before sensitive material goes anywhere near it. DI Cloud runs no second authentication factor of its own: signing in rests on a password, a one-time code sent by email, or an Apple or Google account, so an account is exactly as resistant as the method chosen for it. A public conversation link works with no sign-in; the page is excluded from indexing and by default shows messages as they stood at the moment of sharing, yet it stays live until the owner revokes it or a set expiry passes. A preview issued as a signed link is valid for one hour, and during that hour it opens for anyone who receives it. None of these rules judges what gets typed into a prompt, which is why safe use of the tool remains partly with the person working at it.