Search Request a Close Beta spot

Technology and security

Here we explain how Illumentis is built and how we protect your texts. The articles range from an explanation for everyone to the details for the curious: sign-in, permissions, tests, attack scenarios and the technology behind offline writing. We describe principles, not configuration. The results of our checks are in the monthly report.

  • Reading the security report

    The security report shows what we checked and what came out of it. We produce it monthly; for now we start the run by hand. It is a self-assessment and not an independent test.

  • How we test

    We check Illumentis on several levels: with automated tests, with tests that search the whole code for patterns, with targeted attack attempts and with scans. A change has to pass these checks before it is released. Figures and results are in the monthly report.

  • The 14 attack scenarios

    An attack scenario asks: what happens if someone takes over this account or tries this route? Each of the 14 scenarios has automated tests whose result is in the monthly report. Some scenarios have documented limits, which we state openly.

  • Sign-in and two-factor authentication

    In short: your account is secured by your password, optionally by a second factor, and by protecting your sessions. If you lose access, there is a recovery key and, as a way out, an identity check. This only stays secure as long as your device and your email account are.

  • Permissions and roles

    In short: who may see or change something in a project depends on their relationship to the project, and every request is checked centrally. Projects are separated from each other, and user management admins do not see book contents. Authorized people can still copy content, though.

  • Offline and installation (PWA)

    In short: Illumentis runs in the browser and can be installed as an app. If the connection drops, you keep writing, your text is saved locally in the browser and synced with the server later. This has limits, which we name here.

  • Architecture overview

    In short: Illumentis consists of a web app in the browser, an interface on the server, a database, a search and background jobs. The wiki is a separate system. We describe the building blocks in simplified form and deliberately name no versions and no server layout.

  • Tests that check the whole code

    An ordinary test checks a case we already know. A meta test searches the whole code for a pattern and fails as soon as something new violates it. This way a security rule is not lost just because we build something new.

  • Inputs, uploads and imports

    Everything that comes from outside is checked before Illumentis processes it: texts from the editor, uploaded files and imports. We allow only what we explicitly know and reject everything else instead of changing it silently. This reduces the risk, but no check finds everything.

  • Protection in the browser

    In short: on devices that others also use, you can give Illumentis extra protection. Shared device mode locks the app when it is idle, encrypts the local cache and can hide the text while the tab is in the background. It protects against casual glances and quick access, not against every attacker.

  • Integrity and supply chain

    All other safeguards assume that the running code matches the checked state. That is why we detect later changes to the code, separate permissions and release only what has passed the check pipeline. Part of the hardening of the delivery is still open; this is stated in the monthly report.

  • Reliability: saving and recovery

    In short: Illumentis saves your text while you write, notices conflicts instead of overwriting something, and keeps deleted items in the trash first. That is not a promise against data loss, so your own export is a sensible backup.

  • Editor and synchronization

    In short: your text is stored as a structured tree and not as loose characters. We derive scenes on the server from this text, and every change carries a version so that conflicts stand out. This keeps text and scene data together, even when several people and devices are involved.

  • Continuity check: the principle

    The Illuminatio Engine checks with fixed rules whether your story fits the facts you have recorded yourself. Every hint names the objects involved and can be traced. The engine points things out and does not judge; you decide.

  • Data export and emergencies

    In short: you can export your projects and your account data and take them with you. The project backup can be imported again and encrypted with your own key. What applies if you lose access is described here, and for everything we cannot promise, we say so openly.