Security
Tempered by architecture
We never store your documents on our servers, and no third-party AI service sees them. Here is exactly what happens, from the molten moment of upload to the final act of destruction.
Architecture
Molten channels
Foundation
Four walls of volcanic glass
Obsidian Containment
Each vault is forged on a GPU dedicated to it, rented from independent hosts on a third-party GPU marketplace. The GPU is yours alone; the host machine’s CPU, disk and network may be shared with other renters.
Transport
Uploads reach Obsidian over TLS 1.3 from your browser and are relayed to your vault’s GPU instance without being stored by us. The hop from our servers to the instance is not yet encrypted. This is not end-to-end encryption: your instance holds your documents in the clear, because it has to read them to answer questions about them.
Dedicated GPU
We orchestrate. The Obsidian API handles vault status, billing, provisioning and, when chat saving is on (the default), your saved questions and replies. Your document content is smelted on the GPU dedicated to your vault.
No Third-Party AI
No third-party AI service ever sees your documents. The instance downloads its model weights and packages at startup, and the open-source model answers from your documents on your vault’s GPU.
Lifecycle
From ore to oblivion
Four stages. Each one seals the one before it.
MINE
Provision
A GPU dedicated to your vault is carved from raw silicon, usually in minutes and occasionally up to 20. Hosts are in the US, Canada, the UK, Germany, France, the Netherlands, Sweden, Norway, Finland, Poland, Czechia, Austria, Ireland and Australia.
SMELT
Upload
Documents are uploaded over TLS 1.3, relayed through the Obsidian API without being stored there, and land on your vault’s GPU instance, where they are indexed and held on that instance’s own disk for the life of the vault. PDFs are read by text extraction (scanned PDFs are not OCR’d); PNG and JPG images are OCR’d.
FORGE
Analyze
AI inference runs on your vault’s GPU: documents are parsed, embedded into vector space, and analyzed on the instance. We keep no copies of your documents. With chat saving on (the default), your questions and the AI’s replies are stored in our database.
SHATTER
Destroy
When you destroy a vault, its GPU instance and disk are deleted at the GPU provider. The glass shatters. The vault’s saved chat history is deleted from our database at the same time.
Compliance
Forged to meet your requirements
What Obsidian does today for teams in healthcare, finance, legal and the public sector. We hold no compliance certifications.
Confidential Work
Built for confidential work: a dedicated GPU per vault and open-source models, with no third-party AI service in the loop.
GDPR Ready
Self-service data export and account deletion in Settings. Destroying a vault deletes its GPU instance and disk.
Audit Trail
Vault, document and specialist events are logged with timestamps and exportable as CSV.
Privileged Documents
Your documents stay on the GPU instance rented for your vault and are deleted with it. We do not read your files.
Note: Obsidian provides the technical infrastructure to support compliance. Compliance certification depends on your organization's overall security posture and implementation.