Documentation Index
Fetch the complete documentation index at: https://docs.teeem-ai.com/llms.txt
Use this file to discover all available pages before exploring further.
Teeem AI is designed for Korea’s regulatory environment (PIPA, AI Basic Act) and global best practices. Security is a default, not an option.
Data isolation
Other customers cannot reach your data — there is no code path for it.
| Store | Isolation boundary |
|---|
| PostgreSQL (RDS) | Per-customer dedicated instance — physically separate database |
| Sessions (DynamoDB) | Per-customer tables, per-customer KMS keys |
| Files (EFS) | Per-customer file system |
| Secrets | SSM Parameter Store SecureString with per-customer prefix |
| Slack tokens | AWS Secrets Manager, isolated |
PII masking (10 Korean PII types)
Masking happens before the message reaches the LLM and is reversed just before the response goes back to the user.
| PII type | Example |
|---|
| Resident registration number | 860101-1234567 → [RRN-1] |
| Phone | 010-1234-5678 → [PHONE-1] |
| Credit card | 4567-1234-5678-9012 → [CARD-1] |
| Korean name | 김철수 → [NAME-1] |
| Business registration number | 123-45-67890 → [BRN-1] |
| Passport | M12345678 → [PASSPORT-1] |
| Driver’s licence | 12-34-567890-12 → [LICENSE-1] |
| Bank account | 123-456-789012 → [ACCOUNT-1] |
| Address | 서울 강남구 ... → [ADDR-1] |
| Health insurance | 1-1234567890 → [HEALTH-1] |
Prompt-injection defence
Inbound messages — and any external content (email bodies, web pages, document contents) — are checked by an injection detector that recognises both Korean and English patterns.
Additional defence layers:
- Output leak detection — monitors for PII or secrets escaping in responses
- Input length guard — protects against ReDoS
- Shell isolation — code-execution tools run only in sandboxed environments
Access control
6-tier RBAC
platform_admin → enterprise_admin → team_admin → power_user → user → viewer
ABAC (data classification)
Data carries a classification label.
public → internal → confidential → secret
confidential data be handled by team_admin or above, secret by enterprise_admin only — and so on.
IP allowlist
Restrict access to specific CIDRs. Useful when the agent should only be reachable from inside the company network.
Specific tools (external sends, payments, bulk data downloads) can require human approval before execution.
SSO
Integrate with the IdP your company already uses.
- SAML 2.0 — Okta, OneLogin, Azure AD, etc.
- OIDC — Google Workspace, Auth0, etc.
With SSO, users and groups sync via SCIM and offboarding revokes access automatically.
Audit log
Every activity is recorded — sign-ins, messages, tool executions, settings changes, KB uploads, OAuth links, and more.
- Tamper-evident — entries are linked by SHA256 hashes; modifying any entry breaks the chain
- Integrity verification API — anyone can verify integrity at a chosen point in time
- 5-year retention — default, matched to Korean regulatory requirements
- Compliance package export — audit log + PII statistics + RBAC matrix exported as a single ZIP
AI Basic Act watermarking
Per Korea’s AI Basic Act Article 27, AI-generated content carries a watermark.
| Output | Watermark format |
|---|
| Text | Visible label (e.g. “AI-generated content”) + metadata |
| Documents (PDF, PPTX, DOCX) | Footer or generation metadata |
| HTTP responses | Header marker |
PIPA (Korean privacy law)
- Minimisation — only the PII required for the task is processed
- Purpose limitation — no reuse for other purposes
- Encrypted storage — KMS, AES-256-GCM
- Access control — RBAC + ABAC + audit logging
- Deletion requests — API for personal-data deletion
Container & infrastructure security
| Item | Setting |
|---|
| Container user | non-root (UID 1001) |
| Filesystem | read-only |
| Privilege escalation | no-new-privileges |
| Resource limits | 2 GB RAM / 2 CPU (DoS prevention) |
| Image scanning | ECR vulnerability scanning |
| Network | RDS in private subnets, security groups least-privilege |
| WAF | OWASP rule set + custom rules |
| TLS | ALB termination, HSTS 2 years, CSP applied |
| Boot-time check | 18-item security audit (boot fails on FAIL) |
Compliance report
Hit GET /admin/compliance-report to export an evidence package containing:
- Audit log (with hash-chain integrity proof)
- PII masking statistics (by type and time window)
- RBAC matrix (current per-role permissions)
- External API call log
- AI Basic Act watermarking history
The format is suitable for direct submission to regulators or for ISMS-P recertification.
