Privacy and control

Jiandu starts with a conservative local profile:

• it listens on 127.0.0.1, so other devices cannot connect by accident;
• remote telemetry is off;
• local disk and SQLite are the default data stores;
• external identity providers, capture connectors, and plugins are off until configured;
• the first owner credential is written to an owner-only file rather than printed into logs.

These defaults reduce surprises, but they do not replace normal self-hosting care. You still choose who can reach the machine, how HTTPS is terminated, where backups are kept, and who has administrator access.

Shared by default, restrict when needed

The normal household library is shared. Owners and administrators can assign roles, groups, or custom permission sets. A manager can restrict an exceptional document to particular people or groups with Viewer, Editor, or Manager access.

The installation Owner keeps a recovery grant. An Administrator does not automatically gain access to every restricted document. Keep the Owner credential offline and use an ordinary administrator account for day-to-day work.

External services are choices

S3-compatible storage, WebDAV, OIDC, LDAP, trusted-proxy sign-in, OTLP telemetry, and capture connectors are opt-in. Enabling one creates a new trust relationship. Review the relevant guide and keep credentials in protected files or secret stores rather than committing them to a configuration file.

See protect your data for a practical checklist.