Skip to content
Annotide

Security overview

Annotide is self-hosted: it runs on your infrastructure, under your own security controls. This page is a summary for evaluators; the installation guide has the operational detail.

Media never leaves your storage

Section titled “Media never leaves your storage”

The backend never proxies images, video, audio or documents. The browser reads and writes your object storage (Azure Blob, S3, Google Cloud Storage, or a local mount) directly, using short-lived signed URLs — 15 minutes by default, configurable. Annotide’s own database stores only annotations: the shapes, labels, text and metadata your team creates, never the source media itself.

Identity and access

Section titled “Identity and access”
  • Single sign-on over OIDC, including Microsoft Entra ID, with group-based role mapping and SCIM 2.0 provisioning.
  • Per-project roles — annotator, reviewer, owner, viewer — optionally scoped to a subset of a project’s folders.
  • API keys and service accounts for scripts, CI and AI agents, scoped to exactly what that account may do.
  • Storage connectors prefer a cloud identity (managed identity, IAM role) over long-lived keys; when a key is unavoidable, the connector holds a reference into your own secret store (Key Vault, Secrets Manager, Secret Manager), never the key itself.

Audit log

Section titled “Audit log”

Every sign-in, project change, export, membership change and annotation verdict is recorded with who did it and when, for later review.

Telemetry

Section titled “Telemetry”

A weekly heartbeat is on by default and can be turned off. It carries an install id, counts and salted hashes of organisation signals, never names, e-mail addresses or media. A separate daily licence refresh is not telemetry, and no licence check ever depends on reaching a vendor service. See the installation guide for the exact environment variables, and the licence terms and telemetry notice for the policy.

Deploying on Azure

Section titled “Deploying on Azure”

The reference Terraform module runs every service behind free controls — firewalls, service endpoints, IP allow-lists, Entra ID sign-in, TLS — with no private endpoints, private DNS, NAT gateway or VPN. See the Azure Terraform reference for the trade-offs.