--- title: "Said plainly, for your security review · QueryLlama" description: "What is in place today and what is not, without the marketing." url: "https://royalsoftworks.com/products/queryllama/security/said-plainly/" source: "https://royalsoftworks.com" format: "markdown" note: "Markdown rendering of the HTML page at `url`. Same content, same canonical URL." --- Security · 2 of 2 # Said plainly, for your security review. What is in place today and what is not, without the marketing. What's still being hardened ## Said plainly, for your security review. QueryLlama has not yet had a third-party security audit, and several capabilities described on this site are still in development (see below). If you're evaluating QueryLlama for a regulated environment, talk to us directly about your specific requirements and timeline. Built in the open ## What's running today, and what's next. QueryLlama is pre-launch. Rather than blur the line, every capability on this site is labeled by build status — so a design partner or security reviewer knows exactly what they're evaluating today. ### Multi-tenant isolation (Postgres RLS) Core tables scoped by organization at the database layer; per-role rules and full table coverage still being built. In active development ### Document ingestion: chunking + embeddings The worker chunks text on a sliding window, embeds it via Cloudflare Workers AI and stores it in pgvector — plain text today; upload, queueing and PDF/Office parsing still being built. In active development ### Keyword search (Postgres full-text) Full-text search over indexed document chunks. In active development ### Semantic + hybrid search (RRF) Vector similarity search and a reciprocal-rank-fusion blend of keyword and semantic results. In active development ### RAG question-answering with citations Ask a question, get an answer grounded in retrieved chunks with a link back to source. In active development ### Bring-your-own-LLM (enterprise) Point the answering step at your own OpenAI-compatible endpoint. In active development ### Audit-log event writes The append-only table exists; wiring every action through to it is in progress. In active development ### Group-level permissions & tier billing Finer-grained access rules within an org, and metered plan enforcement. Designed, on the roadmap ## Read the full technical reference. Data model, RLS policy structure, and the architecture behind every claim on this page. [Read the whitepaper](https://royalsoftworks.com/products/queryllama/whitepaper/) [FAQ](https://royalsoftworks.com/products/queryllama/faq/) Written up, not shipped. There is nothing to download yet. · [Get notified →](https://royalsoftworks.com/contact/?product=queryllama&tier=notify) [Previous Built so one organisation never sees another's documents.](https://royalsoftworks.com/products/queryllama/security/isolation/) [All of QueryLlama security](https://royalsoftworks.com/products/queryllama/security/)