'/%3e%3cpath%20id='cross_2'%20data-name='cross%202'%20class='cls-2'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.193%200.007)%20rotate(90)'/%3e%3cpath%20id='cross_3'%20data-name='cross%203'%20class='cls-3'%20d='M20.612,30.43h0a5.361,5.361,0,1,0-10.723,0H0A33.709,33.709,0,0,1,30.569,0V9.75a5.361,5.361,0,1,1,0,10.723V30.43Z'%20transform='translate(67.186%2067.041)%20rotate(180)'/%3e%3cpath%20id='cross_4'%20data-name='cross%204'%20class='cls-4'%20d='M20.6,30.5h0a5.361,5.361,0,1,0-10.723,0H0A33.71,33.71,0,0,1,30.56,0V9.818a5.361,5.361,0,1,1,0,10.723V30.5Z'%20transform='translate(0%2067.041)%20rotate(-90)'/%3e%3c/svg%3e)
Security Policy
SetFN stores uploaded files on the PC or server where it is installed. This document answers questions about data storage, access control, access logs, data handling when using AI, and external access.
Data Storage
Q: Where are files stored?
Files uploaded to SetFN are stored in the data storage path specified during initial setup, on the disk of the PC or server where SetFN is installed. Files are not kept in an external cloud.
Q: Is data ever sent outside?
In the following cases, data leaves the SetFN server.
- When you use external AI models or external search tools, the request and the document content it needs may be sent to that provider.
- When you connect an external AI through MCP, documents, search terms, paths, and activity history within the allowed scope may be sent to the AI provider.
- Features that integrate external services, such as mail and webhooks, exchange data with those services.
- License registration and renewal communicate with the SetFN account server.
Without external access configured, SetFN can only be reached from the same internal network.
Access Control
Q: Can access permissions be set differently per user?
SetFN provides a level- and team-based permission management system.
- Level: Restricts which folders and features a user can access based on their user grade
- Team: Grants folder access permissions on a department or project basis
- Administrator: Holds full system configuration and user management permissions
Q: How is access by outside parties controlled?
Use the following features in Security Settings.
IP Access Restriction: Only IPs in the allow list can access the administrator page.Login protection: Repeated login failures temporarily lock the account or automatically block the IP.Sign-in from a new device: Choose whether to allow, notify, or require approval for sign-ins from devices not seen before.
Blocked IPs can be reviewed and released in Block Management.
Access Logs
Q: Can I see who accessed the system and when?
Access Logs on the administrator page shows user access activity such as sign-ins and sign-outs.
It records the date and time, IP address, operating system, and browser.
Q: Is file change history tracked as well?
In the administrator page, Operations & Audit > Activity Logs shows user actions in the team space, personal, mail, and authentication areas in chronological order. This audit log is available on the Team plan or higher.
For text files such as Markdown, the file's Change Log shows who edited it and when, and lets you restore a previous version.
AI and Security
Q: Does using AI features send data outside the organization?
When you use a local AI runtime (such as Ollama) running on equipment your organization manages, AI processing data does not leave the organization.
When you use external AI models (such as OpenAI), Ollama cloud models, or external search tools, the request may be sent to that service, so using local AI is recommended in security-sensitive environments.
Q: What kind of environment can run local AI?
Local AI connects to an AI runtime (such as Ollama or LM Studio) running on the SetFN server or another server on the same network. It performs faster in environments with a GPU, but it can also be used with CPU only. For setup instructions, see Configure Models & Runtime.
Network Security
Q: How do I connect to SetFN from outside?
You can configure external access with Cloudflare Tunnel, a reverse proxy, a VPN, or similar methods. With Cloudflare Tunnel, you do not need to open a router port, and the origin server's IP address is not published. For the differences between methods, see Choosing an External Access Method.
Q: Can I use SetFN on the internal network only?
Yes. If you do not configure external access, SetFN can only be reached from the internal network (intranet). It can also be operated in a closed network environment with no internet connection. In that case, register a purchased license with a license key issued for the device ID. The Free license requires a linked account and cannot be used offline.