# Security and access

Source: [https://docs.aventail.co.uk/docs/guides/security](https://docs.aventail.co.uk/docs/guides/security)

Review account access, the model endpoint and data handling for your deployment.

### Review each access boundary

Process overview; detailed actions and examples are below.

1.  **Review each access boundary**
    
    Control sign-in does not automatically protect a local model’s serving port.
    
    -   Account access: Use intended accounts and protect keys
    -   Serving endpoint: Review listener, authentication and network rules
    -   Data handling: Review application storage and reporting

**Read the security guidance**

## Account and device access

Use the intended Control account when approving Link. Keep registration keys, device credentials and session files out of source control, logs shared publicly and screenshots. Review account membership and device records when people or machines leave the organisation.

## Network access

The tested local inference endpoint used HTTP. Treat a serving port as a service that needs its own access controls before other machines can reach it. Control sign-in does not automatically protect that port.

Start with loopback access on the same machine. Before enabling remote access, review the listener, authentication and network rules with the person responsible for your deployment. Do not expose the port publicly simply to make an integration connect.

See [network requirements](https://docs.aventail.co.uk/docs/troubleshooting/common-issues#network-requirements) for outbound device connectivity.

## Data handling

Local inference and hosted management are separate data flows. Review what each application and pipeline sends, stores and logs. The [usage-analytics preference](https://docs.aventail.co.uk/docs/privacy/usage-analytics) concerns product analytics; it is not a switch for every form of telemetry.

## Security documentation

For certification evidence, contractual terms, retention requirements or a deployment-specific security review, contact [support@locai.co.uk](mailto:support@locai.co.uk). Obtain the applicable evidence before relying on a certification or compliance claim.