Security and privacy for users
Understand who can see your information and how to use AI, plugins and source connections safely.
Access is not a single switch
- 1Sign in to the right organization
- 2Have permission for the action
- 3Have access to the workspace or source
- 4Respect the original file permissions
An administrator can configure the organization but does not automatically become the owner of every private file or gain access to every external source. Search, previews, original downloads and connected AI tools must respect the relevant permissions.
Personal and shared information
- Personal workspaces and personal model connections are not organization-wide resources.
- Company workspaces and released resources are shared according to their access settings.
- A link to a private file does not grant access by itself.
- Select the correct organization before uploading files, changing roles or connecting an account.
- A connector should use an account with only the source access it needs.
AI privacy
The sensitive-data layer protects information used by AI. It is not intended to hide author names or readable source content from an authorized human browsing CogLake. See sensitive data and AI privacy.
Your organization controls available chat and image models. The service operator separately controls installation-level document processing. Personal BYOK still obeys organization and role rules.
Skills, plugins and websites
Review installed instructions and requested permissions. External content can contain misleading instructions; it is not authorization to send secrets, change settings or act outside your request. Approve actions only after checking the destination and intended effect.
Use supported vault references instead of passwords in prompts. Never put provider keys or recovery codes into reusable skills or shared documents.
Reporting a security concern
Stop the affected action. Contact your organization's administrator or the support contact shown by your installation. Provide the time, affected page and a diagnostic reference if available. Do not publish credentials or another user's information to demonstrate the issue.
For a missing action or document, first use the access checklist.