Secrets encrypted at rest
Connector credentials, webhook signing secrets, SMTP passwords and AI provider keys are encrypted with a key generated on first start. Back it up; nothing else can decrypt them.
Security and architecture
Your findings are a map of your weak points. They stay on your hardware.
PYXA is a single-tenant application you run yourself. There is no PYXA cloud holding your data, no telemetry pipeline, and the source that handles your findings is public under AGPL-3.0.
nginxServes the app over HTTPS on port 443, with a certificate it generates on first start. Bring your own, or terminate TLS at your proxy.
djangoWeb app, API and connectors. Preflight checks the configuration on every start and reports every problem at once.
celeryWorker and scheduler for syncs, verification, threat feeds and notifications.
postgresEverything that matters lives in this one database.
redisCache and task broker only. Nothing in it is unsafe to lose.
Controls
What protects the data inside.
Directory sign-in
Professional and Enterprise. OIDC with discovery for Entra, Okta, Keycloak, Auth0 and Google, or LDAP/AD. Roles come from app roles or group names; nested LDAP groups are not resolved.
Four roles
Administrator, Vulnerability manager, Analyst and Reader. Reader is the default, and the highest matching role wins.
Two-person risk acceptance
The person who requests an exception can never approve it, checked on each request rather than by role. A pending exception hides nothing.
Air-gap ready threat feeds
KEV, EPSS, exploit catalogues and CERT advisories each have their own switch, schedule, and a mirror-or-file option.
AI is optional and yours
Remediation guidance works with OpenAI, Anthropic or a local model, configured by you, or not at all. No AI task can close a finding, approve an exception or change a priority band.
Data handling
Where the data goes.
Findings stay in one database on your server. What PYXA calls out to is listed, recorded and, if you choose, restricted to what you configured.
Stored on your server
Findings, assets, users, exceptions and the audit log live in one Postgres database on the host you run. No PYXA service holds a copy, and nothing reports usage back.
Every outbound call checked
Scanners, threat feeds, ticketing, AI providers and the identity provider are all called through one guard that records each host. In enforce mode, a host no configuration names is refused before a connection opens.
Destinations watched
The certificate of every destination is checked daily, and a change is flagged. A CISA KEV catalogue that arrives more than 5% smaller than the last one is held, not applied.
Limits we state
What PYXA does not do for you.
Self-hosted means some responsibilities are yours. We would rather list them than have you find them.
No managed backup.
Dump the Postgres database on a schedule and store it off the host. File-import directories are not copied into the database, so back those up too.
Compliance is a self-assessment.
Controls PYXA cannot answer from your data show as evidence incomplete or not applicable, never as a pass. It is not a certified audit.
Responsible disclosure
Found a vulnerability in PYXA?
Report it privately following the security policy in the repository. Please do not open a public issue for it.
Read SECURITY.md →