Security and access
How sign-in, API keys, members and dataset permissions work.
Signing in
Every account starts with an email and a password. Two stronger options are available per account, under Settings.
Passkeys. A passkey signs you in with your device’s fingerprint, face or PIN. It verifies you on the device itself, so it works as a full sign-in on its own, with no password and no second step.
Two-step sign-in. Add an authenticator app and trellismem asks for a six-digit code after your password. Setting it up gives you ten single-use recovery codes. Store them somewhere safe: each one signs you in once if you lose the device.
Both are optional and chosen by each person for their own account.
API keys
Agents and automations sign in with API keys, sent in the X-Api-Key header. A key acts as the person who created it.
Keys do not go through two-step sign-in, so agents keep working when their owner turns it on. Treat a key like a password: create one per agent, and delete it on the API keys page when the agent is retired.
Members
The Members page lists the people in your workspace and creates accounts for new teammates.
There is no public sign-up. Only a signed-in member can create an account, so someone who finds the address cannot join your workspace.
Dataset permissions
Access is granted per dataset. There are four permissions:
| Permission | Allows |
|---|---|
| Read | Searching the dataset and seeing its documents and graph |
| Write | Adding and updating documents |
| Delete | Removing documents or the dataset |
| Share | Granting these permissions to others |
The person who creates a dataset holds all four. Share a dataset from its page in the app.
A question with no dataset named searches every dataset the asker can read. A dataset someone cannot read never contributes to their answers.
Isolation
Each dataset has its own graph and its own vector space in the databases. Permissions are checked before a query reaches storage, and the storage itself is separate, so a mistake in one layer does not expose another team’s data.
Stored credentials
Tokens for connected data sources are encrypted before they are stored. The app and the API are served over HTTPS.