Security
For CISOs and IT security reviewers · Last updated: October 16, 2026
Fairspire is built to pass a vendor security review. It runs entirely inside your environment, the data you audit never reaches Black Odix Technologies, and we have no access to your installation. This page summarizes the design. The full Fairspire Security Overview and the server installation guide are available on request at security@blackodix.com.
Where it runs
| Option | How it works |
|---|---|
| Desktop app macOS and Windows | The audit engine runs on the user's own computer and listens on the loopback interface only, so it cannot be reached from the network. Every request needs a random 256-bit key generated for that session; other local applications and browser tabs are rejected. Closing the app stops the engine. |
| Server one container on your infrastructure | A single container (Docker, Podman or Kubernetes), delivered as an image file for networks without registry access. It runs with a read-only filesystem and one data volume. Many people use it through your company sign-in, each department with its own dashboard and review queue. |
There is no Black Odix cloud service. Fairspire works fully offline.
What leaves your environment
- Nothing, by default. No telemetry, no analytics, no usage reporting and no remote access for the vendor.
- The server's only outbound connection is to your identity provider, for single sign-on.
- Two optional features connect to systems you choose, and are off until your IT team configures them: the LLM gateway (which forwards your application's requests to your own LLM endpoint) and live testing of a decision system (limited to an allow-list of hosts, and it never follows a redirect away from them).
- The language model used to check LLM answers is bundled with the product. Nothing is downloaded while it runs.
- Licenses are cryptographically signed (Ed25519) and verified offline. There is no activation or license server.
- Fairspire never updates itself. You decide when to install a new version.
- Anonymous metrics can be exported only if you create the export yourself and decide to share it.
What data Fairspire keeps
Everything is stored in your environment: in the user's profile folder (desktop app) or in the data volume (server).
| Stored | Contents |
|---|---|
| Audit database (SQLite) | Aggregate audit results, review items, users and sessions |
| Evidence ledger | A hash-chained record of every audit, sign-in and review decision, with a built-in integrity check |
| Case identifiers | Kept with review items so reviewers can find the cases: IDs only, never field values. Can be turned off. |
You control retention, backups and encryption at rest (use an encrypted disk or volume). Fairspire does not delete records on its own.
Access control
- Single sign-on with any OpenID Connect provider: Microsoft Entra ID, Okta, Google Workspace, Ping, Keycloak, ADFS. Authorization code flow with PKCE.
- Viewer, auditor and admin roles, separated by department, set by an administrator or mapped from your groups. Sign-in can be limited to your e-mail domains.
- Session idle and maximum lifetimes, CSRF protection and licensed seat limits, all enforced by the server.
- The server refuses to start on a network address without access control (single sign-on or an API key), and refuses plain HTTP unless TLS is configured or a trusted reverse proxy terminates it.
Software supply chain
- Every release ships with a software bill of materials (CycloneDX) and a known-vulnerability report.
- The desktop app's window can only navigate within the local engine, or within your server and your sign-in provider. Other links open in the system browser.
Security testing
Every change to Fairspire's code goes through automated security testing. Before every release and every customer report, the full program runs again:
- Static analysis (SAST) of the source code, and software composition analysis (SCA) of every Python and desktop dependency against public vulnerability databases.
- Dynamic testing (DAST) of the running server: authenticated active attacks on the API and the web dashboard.
- API fuzzing of every endpoint with generated malformed, oversized and unauthenticated requests.
- Secret scanning of the full code history.
Testing targets the OWASP Top 10 and OWASP API Security Top 10 risk categories.
Tamper-evident reports. Each report is sealed by two independent RFC 3161 timestamp authorities, FreeTSA and DigiCert, so a customer can verify with standard tools that no result was changed or backdated. Full reports are available to customers under NDA.
During a pilot
Fairspire is installed on your computers or servers and your team runs the audits. We guide you remotely; we do not need, and do not ask for, access to your data or systems. You keep every report.
Reporting a vulnerability
If you believe you have found a security issue in Fairspire or on this website, write to security@blackodix.com with the details and how to reproduce it. We will acknowledge your report, keep you informed while we fix it, and ask that you give us reasonable time before disclosing it publicly. Please do not access other people's data, disrupt services or test systems you do not own. Our contact details are also published in security.txt.