Network and data flows
This page is for security and compliance reviewers. It states what an on-prem Anthara deployment does on the network and with data, as the installer and the service code define it. Each statement comes from the installer’s templates or the service code.
Inbound traffic
Section titled “Inbound traffic”The installer configures the ufw firewall on the VM.
| Rule | Value |
|---|---|
| Default for incoming traffic | Deny |
| Allowed incoming ports | 22 (SSH), 80 (HTTP), 443 (HTTPS) |
| Default for outgoing traffic | Allow |
With TLS on, nginx redirects HTTP to HTTPS, accepts TLS 1.2 and 1.3, and sends an HSTS header.
Three public paths accept requests from outside services without a user session. Each one verifies the caller in its own way.
| Path | Caller | Verification |
|---|---|---|
/api/github/webhooks |
GitHub | HMAC signature in X-Hub-Signature-256 |
/api/azure-devops/webhooks |
Azure DevOps | Basic auth with a shared secret |
/api/teams/webhook |
Microsoft Teams | Bot Framework token. See the note below. |
Outbound traffic
Section titled “Outbound traffic”The firewall does not restrict outgoing connections. The destinations below are the ones the code and installer use.
While running
Section titled “While running”| Destination | Why |
|---|---|
| Anthropic | Repository assessments. Also workflow runs, when the workflow LLM gateway setting is off. |
| OpenAI | Fabric extracts and embeds memory with OpenAI models by default. |
| Model providers you register | Requests that pass through the LLM Proxy go to the provider of the routed model. |
| GitHub and Azure DevOps | Listing and cloning repositories, and opening pull requests. |
| Jira | Reading issues for workflows, when a Jira connection exists. |
| Microsoft | Posting Teams cards and messages. |
| Your sign-in provider | GitHub, Google, or Microsoft, during sign-in. |
| The Git host of the Anthara plugin | The API clones the plugin repositories for assessments and for the Activate pull request. Workflow workers clone the plugin when they start. The repository URL and its access token are set at install time. |
During installation and upgrade
Section titled “During installation and upgrade”| Destination | Why |
|---|---|
| Docker’s package repository | Installing Docker |
| Ubuntu package mirrors | Installing nginx, the firewall, Node.js, and npm |
get.k3s.io |
Installing k3s |
| The npm registry | Installing the Claude Code CLI on the VM |
Docker Hub, docker.litellm.ai, and ghcr.io |
Pulling PostgreSQL, Redis, FalkorDB, LLM Proxy, and Presidio images |
Optional heartbeat
Section titled “Optional heartbeat”The installer can send a heartbeat to Anthara after each run. It is off by default.
When on, it posts the customer name, the VM’s hostname and IP address, the release name, a timestamp, and the playbook name.
Graph telemetry
Section titled “Graph telemetry”Which model traffic passes through the LLM Proxy
Section titled “Which model traffic passes through the LLM Proxy”The LLM Proxy is where tool rules, data protection, and request logs apply. Not all model traffic passes through it.
| Traffic | Through the proxy? |
|---|---|
| Claude Code sessions that are pointed at the proxy | Yes |
| Workflow runs | Only when an admin has turned on Workflow LLM gateway. Otherwise workers call Anthropic directly. If the setting is on but the proxy address or key is missing, the run also falls back to Anthropic directly and logs a warning. |
| Repository assessments | No. The API calls Anthropic directly with the key set at install time. |
| Fabric memory extraction and embedding | No. Fabric calls its model provider directly. |
The proxy’s public path, /llm-proxy/, is published only when TLS is on.
On an on-prem deployment, the installer turns on header forwarding in the proxy. This lets a developer’s own Claude subscription login pass through to the provider. The proxy container itself holds no Anthropic key by default.
Where secrets are stored on the VM
Section titled “Where secrets are stored on the VM”| File | Contents |
|---|---|
/opt/anthara/.env |
Every service secret and API key |
/opt/anthara/secrets/github-app.pem |
The GitHub App private key |
/opt/anthara/docker-compose.yml |
Includes the database, FalkorDB, and Redis passwords and the proxy’s master key |
/home/<service user>/.claude.json |
The Anthropic API key used for assessments |
/opt/anthara/kube/config |
A token for the service account that starts workflow workers. The account is limited to its own namespace. |
Restrict shell access to the VM, and keep these files readable only by the accounts that need them.
How stored credentials are protected
Section titled “How stored credentials are protected”- Connection tokens. OAuth tokens for GitHub, Azure DevOps, Jira, and Microsoft Teams are encrypted with AES-256-GCM before they are stored.
- Session cookie. The web session is a signed token in an
HttpOnlycookie namedaccess_token. It lasts 24 hours and is markedSecurein production.
What is recorded
Section titled “What is recorded”| Record | Default | Where to change it |
|---|---|---|
| Request logs in the proxy | Kept for 180 days | Logs |
| Prompt and response text in request logs | Set by Store Prompts in Spend Logs | Logs |
Content of search_memories and get_relevant_standards calls in Fabric’s audit log |
Not captured. AUDIT_CAPTURE_CONTENT turns it on at install time. When on, the audit log can hold personal data. |
Ask whoever administers your deployment |
| Masking of personal data | Off | Data Protection |
Workflow workers
Section titled “Workflow workers”Each workflow step runs as a Kubernetes job on the VM’s k3s cluster.
- A worker shares the VM’s network namespace.
- A failed worker is not retried.
- The agent inside a worker runs with tool permissions bypassed, so the tool rules that apply to it are the proxy’s rules. Those rules apply only when workflow traffic passes through the proxy.