Pre-release. Ophiolite runs today for design partners; public source and server image publication are in preparation.

Ophiolite

Trust

Your server, your data, your way out

Ophiolite runs inside your boundary. This page says where each part runs, what leaves it, how it is secured and tested, and how you leave with your data.

Owner-hosted

Ophiolite runs on your servers, with your object storage and your organisation's sign-in. Using it does not mean placing your data in our account: there is no hosted service for your own data today, and the trial workspace we run holds public sample data only.

Everything inside your boundaryThe Workspace, the API, the metadata and permission core, your storage and the runners all run on your own servers, with your sign-in.Your sign-inyour organisation'sproviderYour serverthe API andthe coreYour storagelocal orS3-compatibleNothing outa deploymentsends nothing to us
  • Available

    Workspace

    The browser application; an ordinary client of the public API.

  • Available

    Gateway

    One typed API for every operation, with the same permission checks for every kind of caller.

  • Available

    Metadata and permission core

    Versions, context, interpretation, grants and audit in one store, so one read answers consistently.

  • Partial

    Object storage

    Local disk or S3-compatible storage with verified range reads.

    Streaming past 32 MiB per representation is not yet qualified; Multi-node storage is not qualified

  • Available

    Runners

    Containers for jobs and agents, without network.

    No GPU or distributed scheduling

  • Partial

    Server image

    All of it in one image with backup, restore and upgrade.

    Clean-host qualification on the consolidated composition is still open; Available to design partners; there is no public download

Nothing leaves by default

A deployment sends nothing to us. Its record, its audit and its diagnostics stay on your deployment, with the access and retention you set.

This site installs no analytics, advertising scripts, account forms or tracking cookies, and loads nothing from other sites. The documentation's preferences are stored in your browser only. The hosting service processes ordinary network requests to deliver pages, including IP addresses; that logging is separate from any analytics. The site does not connect to a scientific project.

Security

  • Available

    Sign-in

    Your organisation's sign-in provider, or a sign-in token, with one session policy for the browser, Python and applications that a health check compares with the running server.

  • Available

    Agents

    Scoped agent keys with budgets and an expiry; every change is a plan a person approved; approval never happens over MCP.

  • Available

    Sandboxed runs

    One container per job with no network, no registry, a read-only root and resource limits.

  • Available

    AI use

    Permission per reader and purpose, separate from permission to read; search stays inside your boundary.

  • Available

    Sharing

    Every read and change is checked against the same permissions, whoever calls; a sharing change names the version it read.

  • Available

    Access keys and hand-over

    Scoped keys, project service accounts and a hand-over when someone leaves.

Sessions

A sign-in ends after seven days without use and after thirty days at most. The provider's access tokens last five minutes and renew silently.

Technical details

The numbers are one declaration in the server:

IDLE = 7 * 86400
ABSOLUTE = 30 * 86400

Runner limits

Each job runs with no network and a read-only file system, within limits on memory, time, processors, processes and output.

Technical details

The limits per job, quoted from the runner:

DEFAULTS = {'memory_mb': 256, 'seconds': 60, 'cpus': 1.0, 'pids': 64
network='none'

Qualification record

Available Before release, an agent that did not build the code attacks the whole chain, from sign-in to exit. The last run passed 1,979 checks after 3 findings were fixed. There is no external audit yet.

Report a security problem to security@ophiolite.dev.

Leaving with your data

Identity, exact versions, units, missing values, axes and coordinate claims stay with the data. Originals are kept where permitted. What is unknown stays visible, and a conversion that loses something says so.

Available Export exact versions with their context and lineage; open them on a clean machine with an independent reader, networking off; verify the hashes and reproduce a recorded calculation. Revoking access later cannot recall copies already exported.

Holding data does not give anyone the right to train on it. AI use is a separate permission per reader and purpose, and nothing is used to train across organisations.

Licence and source

Partial Ophiolite's own code is licensed Apache-2.0 (copyright Stefan Crooijmans). Source publication is in preparation; the source is not public today. This site, the documentation and the Python SDK repository are public.

Publication will be a release snapshot of the server, the SDK, the connectors and the documentation, with notices for every third-party component. Contributions will use the Developer Certificate of Origin; there is no contributor licence agreement.

Principles

  1. 01

    Keep scientific meaning intact.

    Identity, units, missing values, axes, coordinate claims and exact versions are preserved; unknowns and conversion losses are shown.

  2. 02

    Make independence practical.

    You can read and reuse your permitted data, its provenance and interpretations without us; exit does not depend on renewing our application.

  3. 03

    Respect the data authority.

    Permissions are checked at every read, run and publication; each asset has one authoritative home.

  4. 04

    Own the history, too.

    The record says how a result was made; diagnostics have another purpose and never replace it.

  5. 05

    Make AI use explicit.

    Holding data confers no training right; AI use is a separate, recorded permission, and there is no training across organisations.

  6. 06

    Qualify before claiming.

    Nothing on this site is shown as available until it is merged and tested; limits are stated, and what is not planned is said plainly.